A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade javassist-javadocUpgrade xml-commons-resolverUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-coreUpgrade jackson-databindUpgrade python3-nssUpgrade glassfish-fastinfosetUpgrade xsomUpgrade glassfish-jaxb-runtimeUpgrade apache-commons-collectionsUpgrade jackson-jaxrs-json-providerUpgrade xerces-j2Upgrade xalan-j2Upgrade xmlstreambufferUpgrade velocityUpgrade glassfish-jaxb-apiUpgrade slf4jUpgrade python-nss-docUpgrade javassistUpgrade jakarta-commons-httpclientUpgrade stax-exUpgrade xml-commons-apisUpgrade jackson-annotationsUpgrade slf4j-jdk14Upgrade apache-commons-langUpgrade bea-stax-apiUpgrade jackson-module-jaxb-annotationsUpgrade jackson-coreUpgrade jackson-jaxrs-providersUpgrade relaxngDatatype | May 4, 2022 | Oct 12, 2019 |
| Centos_linux | — | Upgrade pki-toolsUpgrade xml-commons-apisUpgrade xsomUpgrade jackson-module-jaxb-annotationsUpgrade resteasyUpgrade relaxngDatatypeUpgrade jackson-jaxrs-json-providerUpgrade stax-exUpgrade python-nss-debugsourceUpgrade slf4jUpgrade apache-commons-langUpgrade glassfish-jaxb-apiUpgrade python3-nss-debuginfoUpgrade pki-serverUpgrade jackson-databindUpgrade jackson-jaxrs-providersUpgrade pki-kraUpgrade python3-pkiUpgrade pki-servlet-engineUpgrade jss-javadocUpgrade pki-symkey-debuginfoUpgrade jackson-coreUpgrade tomcatjssUpgrade slf4j-jdk14Upgrade jss-debugsourceUpgrade jackson-annotationsUpgrade velocityUpgrade python3-nssUpgrade python-nss-docUpgrade glassfish-jaxb-runtimeUpgrade javassist-javadocUpgrade pki-core-debugsourceUpgrade bea-stax-apiUpgrade jss-debuginfoUpgrade glassfish-jaxb-txw2Upgrade xalan-j2Upgrade glassfish-fastinfosetUpgrade javassistUpgrade jssUpgrade pki-caUpgrade xml-commons-resolverUpgrade apache-commons-collectionsUpgrade pki-core-debuginfoUpgrade pki-symkeyUpgrade jakarta-commons-httpclientUpgrade pki-servlet-4.0-apiUpgrade pki-tools-debuginfoUpgrade pki-base-javaUpgrade xerces-j2Upgrade xmlstreambufferUpgrade ldapjdk-javadocUpgrade glassfish-jaxb-coreUpgrade pki-baseUpgrade ldapjdk | Apr 29, 2020 | Oct 12, 2019 |
| Debian | — | Upgrade jackson-databind | Dec 12, 2019 | Oct 12, 2019 |
| Oracle_linux | — | Upgrade jss-javadocUpgrade jackson-databindUpgrade glassfish-jaxb-txw2Upgrade jackson-jaxrs-json-providerUpgrade ldapjdkUpgrade resteasyUpgrade xalan-j2Upgrade xerces-j2Upgrade javassist-javadocUpgrade glassfish-jaxb-runtimeUpgrade relaxngDatatypeUpgrade pki-baseUpgrade xmlstreambufferUpgrade apache-commons-collectionsUpgrade xml-commons-resolverUpgrade pki-servlet-4.0-apiUpgrade xsomUpgrade glassfish-fastinfosetUpgrade pki-caUpgrade tomcatjssUpgrade pki-base-javaUpgrade glassfish-jaxb-coreUpgrade pki-serverUpgrade pki-symkeyUpgrade python3-nssUpgrade javassistUpgrade python3-pkiUpgrade jakarta-commons-httpclientUpgrade slf4j-jdk14Upgrade velocityUpgrade apache-commons-langUpgrade jssUpgrade glassfish-jaxb-apiUpgrade slf4jUpgrade pki-toolsUpgrade jackson-annotationsUpgrade bea-stax-apiUpgrade jackson-coreUpgrade python-nss-docUpgrade pki-servlet-engineUpgrade stax-exUpgrade jackson-module-jaxb-annotationsUpgrade pki-kraUpgrade jackson-jaxrs-providersUpgrade xml-commons-apisUpgrade ldapjdk-javadoc | Jul 22, 2024 | Oct 12, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Oct 12, 2019 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Oct 12, 2019 |
| Redhat_linux | — | Upgrade jackson-jaxrs-providersUpgrade velocityUpgrade pki-symkey-debuginfoUpgrade python-nss-docUpgrade jackson-databindUpgrade pki-servlet-engineUpgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-coreUpgrade jakarta-commons-httpclientUpgrade bea-stax-apiUpgrade python3-nssUpgrade pki-baseUpgrade pki-tools-debuginfoUpgrade ldapjdkUpgrade slf4j-jdk14Upgrade jackson-jaxrs-json-providerUpgrade xerces-j2Upgrade javassistUpgrade apache-commons-collectionsUpgrade python3-pkiUpgrade xmlstreambufferUpgrade ldapjdk-javadocUpgrade pki-symkeyUpgrade stax-exUpgrade tomcatjssUpgrade xsomUpgrade relaxngDatatypeUpgrade python3-nss-debuginfoUpgrade jss-debuginfoUpgrade xalan-j2Upgrade pki-core-debugsourceUpgrade pki-kraUpgrade resteasyUpgrade apache-commons-langUpgrade slf4jUpgrade python-nss-debugsourceUpgrade glassfish-jaxb-runtimeUpgrade jssUpgrade xml-commons-resolverUpgrade xml-commons-apisUpgrade pki-base-javaUpgrade jackson-annotationsUpgrade jss-debugsourceUpgrade jackson-coreUpgrade pki-servlet-4.0-apiUpgrade javassist-javadocUpgrade pki-core-debuginfoUpgrade pki-caUpgrade jss-javadocUpgrade jackson-module-jaxb-annotationsUpgrade pki-toolsUpgrade glassfish-jaxb-txw2Upgrade glassfish-fastinfosetUpgrade pki-server | Apr 29, 2020 | Oct 12, 2019 |
| Rocky_linux | — | Upgrade python-nss-docUpgrade python-nss-debugsourceUpgrade python3-nssUpgrade python3-nss-debuginfo | Mar 12, 2024 | Oct 12, 2019 |
| Suse | — | Upgrade jackson-databind | Feb 4, 2022 | Oct 12, 2019 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Oct 12, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub