A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade bea-stax-apiUpgrade javassistUpgrade slf4j-jdk14Upgrade glassfish-jaxb-apiUpgrade relaxngDatatypeUpgrade xml-commons-apisUpgrade jackson-module-jaxb-annotationsUpgrade stax-exUpgrade apache-commons-langUpgrade slf4jUpgrade jackson-annotationsUpgrade python-nss-docUpgrade jakarta-commons-httpclientUpgrade jackson-jaxrs-providersUpgrade jackson-coreUpgrade velocityUpgrade xmlstreambufferUpgrade xerces-j2Upgrade apache-commons-collectionsUpgrade xsomUpgrade javassist-javadocUpgrade xml-commons-resolverUpgrade glassfish-fastinfosetUpgrade xalan-j2Upgrade glassfish-jaxb-runtimeUpgrade jackson-databindUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-coreUpgrade python3-nssUpgrade jackson-jaxrs-json-provider | May 4, 2022 | Oct 12, 2019 |
| Centos_linux | — | Upgrade jssUpgrade pki-tools-debuginfoUpgrade glassfish-jaxb-coreUpgrade javassistUpgrade python-nss-docUpgrade xalan-j2Upgrade glassfish-jaxb-txw2Upgrade pki-servlet-4.0-apiUpgrade javassist-javadocUpgrade xmlstreambufferUpgrade jakarta-commons-httpclientUpgrade pki-symkeyUpgrade pki-core-debuginfoUpgrade glassfish-fastinfosetUpgrade python3-nssUpgrade glassfish-jaxb-runtimeUpgrade pki-caUpgrade apache-commons-collectionsUpgrade pki-baseUpgrade pki-base-javaUpgrade xerces-j2Upgrade xml-commons-resolverUpgrade pki-core-debugsourceUpgrade jss-debuginfoUpgrade ldapjdk-javadocUpgrade ldapjdkUpgrade bea-stax-apiUpgrade relaxngDatatypeUpgrade jackson-jaxrs-providersUpgrade pki-toolsUpgrade slf4jUpgrade jackson-annotationsUpgrade pki-serverUpgrade jackson-jaxrs-json-providerUpgrade python3-nss-debuginfoUpgrade jss-debugsourceUpgrade python-nss-debugsourceUpgrade slf4j-jdk14Upgrade jss-javadocUpgrade jackson-coreUpgrade pki-symkey-debuginfoUpgrade xml-commons-apisUpgrade resteasyUpgrade jackson-module-jaxb-annotationsUpgrade python3-pkiUpgrade xsomUpgrade velocityUpgrade pki-servlet-engineUpgrade pki-kraUpgrade stax-exUpgrade tomcatjssUpgrade jackson-databindUpgrade glassfish-jaxb-apiUpgrade apache-commons-lang | Apr 29, 2020 | Oct 12, 2019 |
| Debian | — | Upgrade jackson-databind | Dec 12, 2019 | Oct 12, 2019 |
| Oracle_linux | — | Upgrade jackson-coreUpgrade python3-pkiUpgrade javassistUpgrade jackson-module-jaxb-annotationsUpgrade ldapjdk-javadocUpgrade jackson-jaxrs-providersUpgrade apache-commons-langUpgrade slf4j-jdk14Upgrade stax-exUpgrade pki-servlet-engineUpgrade python-nss-docUpgrade glassfish-jaxb-apiUpgrade jakarta-commons-httpclientUpgrade pki-kraUpgrade bea-stax-apiUpgrade pki-toolsUpgrade jackson-annotationsUpgrade slf4jUpgrade xml-commons-apisUpgrade jssUpgrade velocityUpgrade python3-nssUpgrade pki-servlet-4.0-apiUpgrade pki-base-javaUpgrade xml-commons-resolverUpgrade ldapjdkUpgrade pki-baseUpgrade xmlstreambufferUpgrade glassfish-jaxb-runtimeUpgrade jackson-databindUpgrade xsomUpgrade jackson-jaxrs-json-providerUpgrade pki-symkeyUpgrade tomcatjssUpgrade resteasyUpgrade jss-javadocUpgrade relaxngDatatypeUpgrade glassfish-fastinfosetUpgrade xalan-j2Upgrade xerces-j2Upgrade pki-serverUpgrade glassfish-jaxb-txw2Upgrade apache-commons-collectionsUpgrade glassfish-jaxb-coreUpgrade javassist-javadocUpgrade pki-ca | Jul 22, 2024 | Oct 12, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Oct 12, 2019 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Oct 12, 2019 |
| Redhat_linux | — | Upgrade ldapjdkUpgrade glassfish-jaxb-coreUpgrade python3-nssUpgrade velocityUpgrade jakarta-commons-httpclientUpgrade pki-baseUpgrade pki-tools-debuginfoUpgrade jackson-jaxrs-providersUpgrade slf4j-jdk14Upgrade python3-pkiUpgrade pki-symkeyUpgrade pki-servlet-engineUpgrade glassfish-jaxb-apiUpgrade xerces-j2Upgrade stax-exUpgrade xmlstreambufferUpgrade javassistUpgrade jackson-databindUpgrade jackson-jaxrs-json-providerUpgrade pki-symkey-debuginfoUpgrade bea-stax-apiUpgrade apache-commons-collectionsUpgrade python-nss-docUpgrade ldapjdk-javadocUpgrade jss-javadocUpgrade jackson-coreUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade glassfish-jaxb-txw2Upgrade pki-base-javaUpgrade jssUpgrade jackson-module-jaxb-annotationsUpgrade pki-kraUpgrade glassfish-fastinfosetUpgrade apache-commons-langUpgrade pki-core-debuginfoUpgrade jss-debugsourceUpgrade pki-toolsUpgrade pki-caUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-apisUpgrade xsomUpgrade xml-commons-resolverUpgrade xalan-j2Upgrade jackson-annotationsUpgrade pki-servlet-4.0-apiUpgrade pki-core-debugsourceUpgrade slf4jUpgrade jss-debuginfoUpgrade tomcatjssUpgrade pki-serverUpgrade resteasyUpgrade javassist-javadocUpgrade relaxngDatatype | Apr 29, 2020 | Oct 12, 2019 |
| Rocky_linux | — | Upgrade python-nss-docUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfoUpgrade python3-nss | Mar 12, 2024 | Oct 12, 2019 |
| Suse | — | Upgrade jackson-databind | Feb 4, 2022 | Oct 12, 2019 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Oct 12, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub