A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade glassfish-jaxb-runtimeUpgrade jackson-databindUpgrade xalan-j2Upgrade xerces-j2Upgrade glassfish-fastinfosetUpgrade glassfish-jaxb-coreUpgrade xsomUpgrade python3-nssUpgrade jackson-jaxrs-json-providerUpgrade apache-commons-collectionsUpgrade javassist-javadocUpgrade glassfish-jaxb-txw2Upgrade xmlstreambufferUpgrade xml-commons-resolverUpgrade slf4jUpgrade apache-commons-langUpgrade slf4j-jdk14Upgrade stax-exUpgrade glassfish-jaxb-apiUpgrade jackson-coreUpgrade jakarta-commons-httpclientUpgrade bea-stax-apiUpgrade xml-commons-apisUpgrade jackson-annotationsUpgrade jackson-module-jaxb-annotationsUpgrade relaxngDatatypeUpgrade jackson-jaxrs-providersUpgrade javassistUpgrade python-nss-docUpgrade velocity | May 4, 2022 | Oct 12, 2019 |
| Centos_linux | — | Upgrade pki-servlet-engineUpgrade jackson-module-jaxb-annotationsUpgrade xml-commons-apisUpgrade resteasyUpgrade xsomUpgrade slf4jUpgrade python3-pkiUpgrade pki-kraUpgrade apache-commons-langUpgrade slf4j-jdk14Upgrade jackson-jaxrs-providersUpgrade jss-debugsourceUpgrade glassfish-jaxb-apiUpgrade python3-nss-debuginfoUpgrade velocityUpgrade pki-symkey-debuginfoUpgrade jackson-databindUpgrade pki-toolsUpgrade stax-exUpgrade jackson-jaxrs-json-providerUpgrade pki-serverUpgrade relaxngDatatypeUpgrade jackson-annotationsUpgrade tomcatjssUpgrade python-nss-debugsourceUpgrade jackson-coreUpgrade jss-javadocUpgrade pki-tools-debuginfoUpgrade ldapjdkUpgrade jssUpgrade xmlstreambufferUpgrade ldapjdk-javadocUpgrade pki-symkeyUpgrade xerces-j2Upgrade glassfish-jaxb-txw2Upgrade pki-servlet-4.0-apiUpgrade jakarta-commons-httpclientUpgrade pki-core-debuginfoUpgrade jss-debuginfoUpgrade pki-caUpgrade python3-nssUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-resolverUpgrade glassfish-jaxb-coreUpgrade javassist-javadocUpgrade pki-core-debugsourceUpgrade pki-base-javaUpgrade pki-baseUpgrade bea-stax-apiUpgrade apache-commons-collectionsUpgrade javassistUpgrade xalan-j2Upgrade python-nss-docUpgrade glassfish-fastinfoset | Apr 29, 2020 | Oct 12, 2019 |
| Debian | — | Upgrade jackson-databind | Dec 12, 2019 | Oct 12, 2019 |
| Oracle_linux | — | Upgrade jackson-module-jaxb-annotationsUpgrade velocityUpgrade glassfish-jaxb-apiUpgrade pki-toolsUpgrade python3-pkiUpgrade jackson-annotationsUpgrade javassistUpgrade jakarta-commons-httpclientUpgrade slf4jUpgrade python3-nssUpgrade jssUpgrade stax-exUpgrade jackson-coreUpgrade python-nss-docUpgrade pki-kraUpgrade xml-commons-apisUpgrade pki-servlet-engineUpgrade bea-stax-apiUpgrade slf4j-jdk14Upgrade jackson-jaxrs-providersUpgrade ldapjdk-javadocUpgrade apache-commons-langUpgrade ldapjdkUpgrade xalan-j2Upgrade pki-serverUpgrade pki-caUpgrade pki-base-javaUpgrade apache-commons-collectionsUpgrade jss-javadocUpgrade resteasyUpgrade glassfish-fastinfosetUpgrade pki-servlet-4.0-apiUpgrade pki-baseUpgrade xerces-j2Upgrade javassist-javadocUpgrade glassfish-jaxb-runtimeUpgrade xsomUpgrade relaxngDatatypeUpgrade glassfish-jaxb-coreUpgrade jackson-databindUpgrade xmlstreambufferUpgrade pki-symkeyUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-txw2Upgrade xml-commons-resolverUpgrade tomcatjss | Jul 22, 2024 | Oct 12, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Oct 12, 2019 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Oct 12, 2019 |
| Redhat_linux | — | Upgrade pki-core-debugsourceUpgrade glassfish-jaxb-txw2Upgrade slf4jUpgrade jss-debuginfoUpgrade python3-nss-debuginfoUpgrade pki-caUpgrade xml-commons-resolverUpgrade jss-javadocUpgrade relaxngDatatypeUpgrade xml-commons-apisUpgrade tomcatjssUpgrade apache-commons-langUpgrade glassfish-fastinfosetUpgrade jackson-annotationsUpgrade pki-kraUpgrade xsomUpgrade resteasyUpgrade python-nss-debugsourceUpgrade jackson-coreUpgrade pki-toolsUpgrade pki-base-javaUpgrade pki-core-debuginfoUpgrade javassist-javadocUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-runtimeUpgrade jackson-module-jaxb-annotationsUpgrade jssUpgrade jss-debugsourceUpgrade xalan-j2Upgrade pki-serverUpgrade pki-symkey-debuginfoUpgrade python3-nssUpgrade ldapjdk-javadocUpgrade ldapjdkUpgrade jackson-jaxrs-providersUpgrade javassistUpgrade apache-commons-collectionsUpgrade velocityUpgrade jakarta-commons-httpclientUpgrade xmlstreambufferUpgrade pki-baseUpgrade python-nss-docUpgrade jackson-databindUpgrade python3-pkiUpgrade slf4j-jdk14Upgrade jackson-jaxrs-json-providerUpgrade pki-symkeyUpgrade pki-servlet-engineUpgrade stax-exUpgrade glassfish-jaxb-coreUpgrade bea-stax-apiUpgrade pki-tools-debuginfoUpgrade glassfish-jaxb-apiUpgrade xerces-j2 | Apr 29, 2020 | Oct 12, 2019 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python3-nssUpgrade python-nss-debugsourceUpgrade python-nss-doc | Mar 12, 2024 | Oct 12, 2019 |
| Suse | — | Upgrade jackson-databind | Feb 4, 2022 | Oct 12, 2019 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Oct 12, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub