A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xsomUpgrade glassfish-fastinfosetUpgrade python3-nssUpgrade apache-commons-collectionsUpgrade xerces-j2Upgrade xml-commons-resolverUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-runtimeUpgrade javassist-javadocUpgrade xmlstreambufferUpgrade jackson-databindUpgrade glassfish-jaxb-txw2Upgrade jackson-jaxrs-json-providerUpgrade xalan-j2Upgrade relaxngDatatypeUpgrade jakarta-commons-httpclientUpgrade python-nss-docUpgrade velocityUpgrade slf4j-jdk14Upgrade xml-commons-apisUpgrade stax-exUpgrade apache-commons-langUpgrade jackson-annotationsUpgrade bea-stax-apiUpgrade jackson-jaxrs-providersUpgrade jackson-coreUpgrade glassfish-jaxb-apiUpgrade slf4jUpgrade jackson-module-jaxb-annotationsUpgrade javassist | May 4, 2022 | Oct 12, 2019 |
| Centos_linux | — | Upgrade pki-caUpgrade xml-commons-resolverUpgrade xmlstreambufferUpgrade ldapjdk-javadocUpgrade javassistUpgrade bea-stax-apiUpgrade glassfish-jaxb-txw2Upgrade apache-commons-collectionsUpgrade glassfish-jaxb-coreUpgrade glassfish-fastinfosetUpgrade xalan-j2Upgrade python-nss-docUpgrade ldapjdkUpgrade jss-debuginfoUpgrade jssUpgrade pki-symkeyUpgrade python3-nssUpgrade pki-core-debugsourceUpgrade pki-tools-debuginfoUpgrade pki-baseUpgrade pki-core-debuginfoUpgrade glassfish-jaxb-runtimeUpgrade javassist-javadocUpgrade xerces-j2Upgrade pki-base-javaUpgrade pki-servlet-4.0-apiUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-apiUpgrade apache-commons-langUpgrade jss-debugsourceUpgrade pki-servlet-engineUpgrade resteasyUpgrade python3-pkiUpgrade jackson-jaxrs-providersUpgrade relaxngDatatypeUpgrade tomcatjssUpgrade pki-toolsUpgrade pki-serverUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade jackson-jaxrs-json-providerUpgrade jackson-annotationsUpgrade stax-exUpgrade jss-javadocUpgrade jackson-module-jaxb-annotationsUpgrade pki-kraUpgrade jackson-databindUpgrade slf4jUpgrade velocityUpgrade slf4j-jdk14Upgrade pki-symkey-debuginfoUpgrade jackson-coreUpgrade xml-commons-apisUpgrade xsom | Apr 29, 2020 | Oct 12, 2019 |
| Debian | — | Upgrade jackson-databind | Dec 12, 2019 | Oct 12, 2019 |
| Oracle_linux | — | Upgrade pki-kraUpgrade stax-exUpgrade glassfish-jaxb-apiUpgrade ldapjdk-javadocUpgrade python-nss-docUpgrade javassistUpgrade xml-commons-apisUpgrade python3-pkiUpgrade slf4jUpgrade jackson-coreUpgrade bea-stax-apiUpgrade jakarta-commons-httpclientUpgrade jssUpgrade pki-servlet-engineUpgrade jackson-jaxrs-providersUpgrade slf4j-jdk14Upgrade velocityUpgrade pki-toolsUpgrade apache-commons-langUpgrade jackson-module-jaxb-annotationsUpgrade python3-nssUpgrade jackson-annotationsUpgrade jackson-jaxrs-json-providerUpgrade pki-baseUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-coreUpgrade pki-symkeyUpgrade resteasyUpgrade jackson-databindUpgrade glassfish-jaxb-txw2Upgrade pki-serverUpgrade xerces-j2Upgrade jss-javadocUpgrade ldapjdkUpgrade xsomUpgrade pki-base-javaUpgrade javassist-javadocUpgrade tomcatjssUpgrade pki-caUpgrade apache-commons-collectionsUpgrade xml-commons-resolverUpgrade xalan-j2Upgrade relaxngDatatypeUpgrade glassfish-fastinfosetUpgrade xmlstreambufferUpgrade glassfish-jaxb-runtime | Jul 22, 2024 | Oct 12, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Oct 12, 2019 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Oct 12, 2019 |
| Redhat_linux | — | Upgrade javassistUpgrade jackson-jaxrs-json-providerUpgrade pki-servlet-engineUpgrade glassfish-jaxb-coreUpgrade jakarta-commons-httpclientUpgrade jackson-jaxrs-providersUpgrade stax-exUpgrade python3-pkiUpgrade xmlstreambufferUpgrade pki-tools-debuginfoUpgrade bea-stax-apiUpgrade glassfish-jaxb-apiUpgrade pki-baseUpgrade xerces-j2Upgrade python-nss-docUpgrade ldapjdk-javadocUpgrade apache-commons-collectionsUpgrade velocityUpgrade python3-nssUpgrade jackson-databindUpgrade slf4j-jdk14Upgrade pki-symkeyUpgrade pki-symkey-debuginfoUpgrade ldapjdkUpgrade glassfish-jaxb-runtimeUpgrade jackson-module-jaxb-annotationsUpgrade tomcatjssUpgrade jssUpgrade xsomUpgrade resteasyUpgrade pki-core-debuginfoUpgrade glassfish-fastinfosetUpgrade jackson-annotationsUpgrade pki-kraUpgrade pki-servlet-4.0-apiUpgrade python3-nss-debuginfoUpgrade jackson-coreUpgrade xml-commons-apisUpgrade glassfish-jaxb-txw2Upgrade xml-commons-resolverUpgrade python-nss-debugsourceUpgrade pki-base-javaUpgrade pki-serverUpgrade xalan-j2Upgrade apache-commons-langUpgrade relaxngDatatypeUpgrade pki-core-debugsourceUpgrade jss-javadocUpgrade slf4jUpgrade pki-toolsUpgrade javassist-javadocUpgrade pki-caUpgrade jss-debugsourceUpgrade jss-debuginfo | Apr 29, 2020 | Oct 12, 2019 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python3-nssUpgrade python-nss-docUpgrade python-nss-debugsource | Mar 12, 2024 | Oct 12, 2019 |
| Suse | — | Upgrade jackson-databind | Feb 4, 2022 | Oct 12, 2019 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Oct 12, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub