The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-databindUpgrade glassfish-jaxb-coreUpgrade jackson-jaxrs-json-providerUpgrade javassist-javadocUpgrade jackson-coreUpgrade xmlstreambufferUpgrade xml-commons-resolverUpgrade python-nss-docUpgrade glassfish-jaxb-txw2Upgrade xml-commons-apisUpgrade apache-commons-langUpgrade glassfish-jaxb-runtimeUpgrade xerces-j2Upgrade xsomUpgrade xalan-j2Upgrade relaxngDatatypeUpgrade jackson-annotationsUpgrade slf4j-jdk14Upgrade bea-stax-apiUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-collectionsUpgrade python3-nssUpgrade jackson-jaxrs-providersUpgrade stax-exUpgrade velocityUpgrade javassistUpgrade glassfish-fastinfosetUpgrade slf4jUpgrade glassfish-jaxb-apiUpgrade jakarta-commons-httpclient | May 4, 2022 | Oct 1, 2019 |
| Centos_linux | — | Upgrade pki-servlet-engineUpgrade python3-pkiUpgrade jackson-annotationsUpgrade glassfish-jaxb-apiUpgrade jakarta-commons-httpclientUpgrade pki-base-javaUpgrade apache-commons-collectionsUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-coreUpgrade javassistUpgrade tomcatjssUpgrade glassfish-jaxb-txw2Upgrade relaxngDatatypeUpgrade ldapjdkUpgrade pki-tools-debuginfoUpgrade bea-stax-apiUpgrade jackson-module-jaxb-annotationsUpgrade pki-symkey-debuginfoUpgrade resteasyUpgrade pki-serverUpgrade jss-javadocUpgrade slf4jUpgrade jss-debugsourceUpgrade ldapjdk-javadocUpgrade apache-commons-langUpgrade velocityUpgrade xalan-j2Upgrade javassist-javadocUpgrade jackson-jaxrs-json-providerUpgrade pki-core-debugsourceUpgrade xerces-j2Upgrade python-nss-docUpgrade slf4j-jdk14Upgrade xml-commons-resolverUpgrade xmlstreambufferUpgrade pki-toolsUpgrade python-nss-debugsourceUpgrade pki-servlet-4.0-apiUpgrade jackson-databindUpgrade pki-baseUpgrade pki-core-debuginfoUpgrade xsomUpgrade python3-nss-debuginfoUpgrade pki-caUpgrade jss-debuginfoUpgrade python3-nssUpgrade xml-commons-apisUpgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-runtimeUpgrade pki-kraUpgrade pki-symkeyUpgrade jssUpgrade jackson-coreUpgrade stax-ex | Apr 29, 2020 | Oct 1, 2019 |
| Debian | — | Upgrade jackson-databind | Oct 4, 2019 | Oct 1, 2019 |
| Oracle Missing Cpu Jul 2020 | — | Apply the July 2020 Critical Patch Update (CPU) for Oracle Database | Jul 14, 2020 | Oct 1, 2019 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 30965714 for version 12.2.1.3.0.Apply the Patch Set Update (PSU) 30970477 for version 12.2.1.4.0. | Apr 25, 2024 | Oct 1, 2019 |
| Oracle_linux | — | Upgrade resteasyUpgrade jackson-coreUpgrade jackson-jaxrs-providersUpgrade jackson-annotationsUpgrade jackson-module-jaxb-annotationsUpgrade ldapjdk-javadocUpgrade jackson-jaxrs-json-providerUpgrade pki-kraUpgrade stax-exUpgrade pki-caUpgrade python3-pkiUpgrade slf4jUpgrade pki-base-javaUpgrade jss-javadocUpgrade pki-servlet-engineUpgrade xml-commons-apisUpgrade glassfish-fastinfosetUpgrade xsomUpgrade apache-commons-langUpgrade slf4j-jdk14Upgrade pki-serverUpgrade tomcatjssUpgrade xalan-j2Upgrade relaxngDatatypeUpgrade pki-toolsUpgrade velocityUpgrade glassfish-jaxb-runtimeUpgrade python3-nssUpgrade xmlstreambufferUpgrade ldapjdkUpgrade pki-baseUpgrade jackson-databindUpgrade glassfish-jaxb-txw2Upgrade apache-commons-collectionsUpgrade jakarta-commons-httpclientUpgrade pki-servlet-4.0-apiUpgrade pki-symkeyUpgrade jssUpgrade xerces-j2Upgrade javassist-javadocUpgrade glassfish-jaxb-apiUpgrade bea-stax-apiUpgrade python-nss-docUpgrade xml-commons-resolverUpgrade javassistUpgrade glassfish-jaxb-core | Jul 22, 2024 | Sep 27, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Sep 27, 2019 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Oct 1, 2019 |
| Redhat_linux | — | Upgrade pki-caUpgrade jss-javadocUpgrade jackson-jaxrs-providersUpgrade pki-tools-debuginfoUpgrade pki-core-debuginfoUpgrade pki-servlet-4.0-apiUpgrade stax-exUpgrade python3-pkiUpgrade xml-commons-apisUpgrade glassfish-jaxb-runtimeUpgrade apache-commons-langUpgrade pki-serverUpgrade python3-nss-debuginfoUpgrade ldapjdkUpgrade jackson-module-jaxb-annotationsUpgrade xsomUpgrade jssUpgrade relaxngDatatypeUpgrade jackson-annotationsUpgrade pki-core-debugsourceUpgrade pki-kraUpgrade tomcatjssUpgrade jackson-databindUpgrade slf4j-jdk14Upgrade xerces-j2Upgrade xmlstreambufferUpgrade resteasyUpgrade jackson-jaxrs-json-providerUpgrade jackson-coreUpgrade xml-commons-resolverUpgrade pki-baseUpgrade jss-debugsourceUpgrade python3-nssUpgrade bea-stax-apiUpgrade velocityUpgrade xalan-j2Upgrade python-nss-debugsourceUpgrade glassfish-jaxb-txw2Upgrade apache-commons-collectionsUpgrade ldapjdk-javadocUpgrade javassistUpgrade pki-toolsUpgrade pki-symkey-debuginfoUpgrade glassfish-jaxb-coreUpgrade python-nss-docUpgrade javassist-javadocUpgrade pki-servlet-engineUpgrade pki-symkeyUpgrade glassfish-jaxb-apiUpgrade glassfish-fastinfosetUpgrade jss-debuginfoUpgrade jakarta-commons-httpclientUpgrade slf4jUpgrade pki-base-java | Apr 29, 2020 | Oct 1, 2019 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python3-nssUpgrade python-nss-docUpgrade python-nss-debugsource | Mar 12, 2024 | Oct 1, 2019 |
| Suse | — | Upgrade jackson-databind | Feb 4, 2022 | Oct 1, 2019 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Oct 1, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub