A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jakarta-commons-httpclientUpgrade jackson-annotationsUpgrade slf4jUpgrade jackson-coreUpgrade bea-stax-apiUpgrade xml-commons-apisUpgrade stax-exUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-apiUpgrade python-nss-docUpgrade apache-commons-langUpgrade jackson-jaxrs-providersUpgrade javassistUpgrade slf4j-jdk14Upgrade velocityUpgrade relaxngDatatypeUpgrade jackson-databindUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-coreUpgrade javassist-javadocUpgrade python3-nssUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-txw2Upgrade apache-commons-collectionsUpgrade xsomUpgrade glassfish-jaxb-runtimeUpgrade xalan-j2Upgrade xmlstreambufferUpgrade xml-commons-resolverUpgrade xerces-j2 | May 4, 2022 | Oct 12, 2019 |
| Centos_linux | — | Upgrade ldapjdk-javadocUpgrade pki-base-javaUpgrade javassistUpgrade apache-commons-collectionsUpgrade jss-debuginfoUpgrade bea-stax-apiUpgrade ldapjdkUpgrade xalan-j2Upgrade glassfish-fastinfosetUpgrade pki-baseUpgrade xml-commons-resolverUpgrade pki-tools-debuginfoUpgrade jssUpgrade xerces-j2Upgrade python3-nssUpgrade pki-core-debugsourceUpgrade glassfish-jaxb-txw2Upgrade python-nss-docUpgrade javassist-javadocUpgrade xmlstreambufferUpgrade glassfish-jaxb-coreUpgrade pki-servlet-4.0-apiUpgrade pki-caUpgrade pki-symkeyUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-runtimeUpgrade pki-core-debuginfoUpgrade slf4j-jdk14Upgrade slf4jUpgrade python-nss-debugsourceUpgrade jackson-jaxrs-json-providerUpgrade jackson-annotationsUpgrade python3-nss-debuginfoUpgrade pki-serverUpgrade xml-commons-apisUpgrade jackson-module-jaxb-annotationsUpgrade velocityUpgrade pki-toolsUpgrade relaxngDatatypeUpgrade jackson-jaxrs-providersUpgrade tomcatjssUpgrade xsomUpgrade jss-javadocUpgrade resteasyUpgrade pki-servlet-engineUpgrade glassfish-jaxb-apiUpgrade pki-kraUpgrade jss-debugsourceUpgrade stax-exUpgrade jackson-databindUpgrade apache-commons-langUpgrade jackson-coreUpgrade pki-symkey-debuginfoUpgrade python3-pki | Apr 29, 2020 | Oct 12, 2019 |
| Debian | — | Upgrade jackson-databind | Dec 12, 2019 | Oct 12, 2019 |
| Oracle_linux | — | Upgrade tomcatjssUpgrade xml-commons-resolverUpgrade xerces-j2Upgrade ldapjdkUpgrade pki-symkeyUpgrade xsomUpgrade jss-javadocUpgrade glassfish-fastinfosetUpgrade apache-commons-collectionsUpgrade pki-serverUpgrade javassist-javadocUpgrade resteasyUpgrade glassfish-jaxb-coreUpgrade pki-baseUpgrade pki-caUpgrade pki-servlet-4.0-apiUpgrade xalan-j2Upgrade glassfish-jaxb-runtimeUpgrade xmlstreambufferUpgrade jackson-databindUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-txw2Upgrade pki-base-javaUpgrade relaxngDatatypeUpgrade pki-toolsUpgrade slf4jUpgrade xml-commons-apisUpgrade ldapjdk-javadocUpgrade javassistUpgrade jackson-jaxrs-providersUpgrade jackson-annotationsUpgrade glassfish-jaxb-apiUpgrade jakarta-commons-httpclientUpgrade pki-kraUpgrade python3-pkiUpgrade pki-servlet-engineUpgrade python-nss-docUpgrade jackson-module-jaxb-annotationsUpgrade jssUpgrade python3-nssUpgrade stax-exUpgrade velocityUpgrade slf4j-jdk14Upgrade apache-commons-langUpgrade bea-stax-apiUpgrade jackson-core | Jul 22, 2024 | Oct 12, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Oct 12, 2019 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Oct 12, 2019 |
| Redhat_linux | — | Upgrade ldapjdkUpgrade xerces-j2Upgrade glassfish-jaxb-apiUpgrade python3-pkiUpgrade bea-stax-apiUpgrade javassistUpgrade pki-baseUpgrade glassfish-jaxb-coreUpgrade jackson-jaxrs-json-providerUpgrade ldapjdk-javadocUpgrade velocityUpgrade python3-nssUpgrade xmlstreambufferUpgrade jakarta-commons-httpclientUpgrade slf4j-jdk14Upgrade pki-symkeyUpgrade pki-servlet-engineUpgrade apache-commons-collectionsUpgrade jackson-jaxrs-providersUpgrade stax-exUpgrade python-nss-docUpgrade pki-symkey-debuginfoUpgrade pki-tools-debuginfoUpgrade jackson-databindUpgrade jss-debuginfoUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-fastinfosetUpgrade pki-core-debugsourceUpgrade slf4jUpgrade glassfish-jaxb-txw2Upgrade pki-servlet-4.0-apiUpgrade jssUpgrade glassfish-jaxb-runtimeUpgrade pki-base-javaUpgrade jackson-coreUpgrade python3-nss-debuginfoUpgrade jss-debugsourceUpgrade xalan-j2Upgrade jss-javadocUpgrade python-nss-debugsourceUpgrade tomcatjssUpgrade pki-serverUpgrade pki-caUpgrade javassist-javadocUpgrade relaxngDatatypeUpgrade pki-toolsUpgrade pki-core-debuginfoUpgrade pki-kraUpgrade resteasyUpgrade jackson-annotationsUpgrade apache-commons-langUpgrade xml-commons-resolverUpgrade xml-commons-apisUpgrade xsom | Apr 29, 2020 | Oct 12, 2019 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade python-nss-doc | Mar 12, 2024 | Oct 12, 2019 |
| Suse | — | Upgrade jackson-databind | Feb 4, 2022 | Oct 12, 2019 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Oct 12, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub