A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xmlstreambufferUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-txw2Upgrade xalan-j2Upgrade glassfish-jaxb-runtimeUpgrade apache-commons-collectionsUpgrade xsomUpgrade jackson-databindUpgrade glassfish-jaxb-coreUpgrade glassfish-fastinfosetUpgrade python3-nssUpgrade xml-commons-resolverUpgrade javassist-javadocUpgrade xerces-j2Upgrade bea-stax-apiUpgrade glassfish-jaxb-apiUpgrade jackson-jaxrs-providersUpgrade jackson-module-jaxb-annotationsUpgrade python-nss-docUpgrade jackson-coreUpgrade stax-exUpgrade xml-commons-apisUpgrade apache-commons-langUpgrade slf4jUpgrade velocityUpgrade jackson-annotationsUpgrade slf4j-jdk14Upgrade javassistUpgrade jakarta-commons-httpclientUpgrade relaxngDatatype | May 4, 2022 | Oct 12, 2019 |
| Centos_linux | — | Upgrade pki-core-debuginfoUpgrade pki-tools-debuginfoUpgrade jakarta-commons-httpclientUpgrade jssUpgrade glassfish-fastinfosetUpgrade javassistUpgrade xml-commons-resolverUpgrade pki-servlet-4.0-apiUpgrade pki-symkeyUpgrade pki-caUpgrade apache-commons-collectionsUpgrade xmlstreambufferUpgrade xalan-j2Upgrade xerces-j2Upgrade glassfish-jaxb-txw2Upgrade pki-baseUpgrade pki-base-javaUpgrade python-nss-docUpgrade javassist-javadocUpgrade pki-core-debugsourceUpgrade glassfish-jaxb-coreUpgrade python3-nssUpgrade glassfish-jaxb-runtimeUpgrade ldapjdk-javadocUpgrade jss-debuginfoUpgrade ldapjdkUpgrade bea-stax-apiUpgrade xml-commons-apisUpgrade jackson-module-jaxb-annotationsUpgrade jss-debugsourceUpgrade apache-commons-langUpgrade slf4jUpgrade glassfish-jaxb-apiUpgrade relaxngDatatypeUpgrade xsomUpgrade pki-servlet-engineUpgrade python3-pkiUpgrade velocityUpgrade jackson-databindUpgrade stax-exUpgrade pki-kraUpgrade jackson-jaxrs-providersUpgrade pki-toolsUpgrade tomcatjssUpgrade resteasyUpgrade jss-javadocUpgrade jackson-coreUpgrade pki-symkey-debuginfoUpgrade slf4j-jdk14Upgrade pki-serverUpgrade jackson-jaxrs-json-providerUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfoUpgrade jackson-annotations | Apr 29, 2020 | Oct 12, 2019 |
| Debian | — | Upgrade jackson-databind | Dec 12, 2019 | Oct 12, 2019 |
| Oracle_linux | — | Upgrade stax-exUpgrade slf4jUpgrade pki-toolsUpgrade jackson-annotationsUpgrade jackson-coreUpgrade bea-stax-apiUpgrade pki-kraUpgrade apache-commons-langUpgrade pki-servlet-engineUpgrade jackson-jaxrs-providersUpgrade jackson-module-jaxb-annotationsUpgrade xml-commons-apisUpgrade ldapjdk-javadocUpgrade jakarta-commons-httpclientUpgrade jssUpgrade slf4j-jdk14Upgrade python3-pkiUpgrade glassfish-jaxb-apiUpgrade javassistUpgrade velocityUpgrade python3-nssUpgrade python-nss-docUpgrade tomcatjssUpgrade pki-serverUpgrade pki-symkeyUpgrade xsomUpgrade glassfish-jaxb-coreUpgrade xmlstreambufferUpgrade glassfish-fastinfosetUpgrade jackson-databindUpgrade glassfish-jaxb-txw2Upgrade jackson-jaxrs-json-providerUpgrade resteasyUpgrade ldapjdkUpgrade apache-commons-collectionsUpgrade javassist-javadocUpgrade xerces-j2Upgrade jss-javadocUpgrade xml-commons-resolverUpgrade pki-caUpgrade pki-base-javaUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-runtimeUpgrade xalan-j2Upgrade relaxngDatatypeUpgrade pki-base | Jul 22, 2024 | Oct 12, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Oct 12, 2019 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Oct 12, 2019 |
| Redhat_linux | — | Upgrade jackson-annotationsUpgrade xml-commons-resolverUpgrade pki-kraUpgrade glassfish-fastinfosetUpgrade pki-serverUpgrade relaxngDatatypeUpgrade javassist-javadocUpgrade glassfish-jaxb-txw2Upgrade jss-javadocUpgrade pki-servlet-4.0-apiUpgrade tomcatjssUpgrade apache-commons-langUpgrade xml-commons-apisUpgrade xsomUpgrade glassfish-jaxb-runtimeUpgrade python3-nss-debuginfoUpgrade jackson-coreUpgrade pki-toolsUpgrade pki-base-javaUpgrade python-nss-debugsourceUpgrade xalan-j2Upgrade jackson-module-jaxb-annotationsUpgrade resteasyUpgrade jss-debugsourceUpgrade slf4jUpgrade jss-debuginfoUpgrade pki-core-debuginfoUpgrade jssUpgrade pki-core-debugsourceUpgrade pki-caUpgrade xmlstreambufferUpgrade pki-tools-debuginfoUpgrade pki-symkeyUpgrade pki-baseUpgrade ldapjdkUpgrade stax-exUpgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-coreUpgrade python3-pkiUpgrade pki-servlet-engineUpgrade jakarta-commons-httpclientUpgrade slf4j-jdk14Upgrade pki-symkey-debuginfoUpgrade python-nss-docUpgrade python3-nssUpgrade velocityUpgrade bea-stax-apiUpgrade jackson-databindUpgrade ldapjdk-javadocUpgrade jackson-jaxrs-json-providerUpgrade jackson-jaxrs-providersUpgrade apache-commons-collectionsUpgrade xerces-j2Upgrade javassist | Apr 29, 2020 | Oct 12, 2019 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python3-nss-debuginfoUpgrade python-nss-docUpgrade python-nss-debugsource | Mar 12, 2024 | Oct 12, 2019 |
| Suse | — | Upgrade jackson-databind | Feb 4, 2022 | Oct 12, 2019 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Oct 12, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub