FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade glassfish-jaxb-coreUpgrade jackson-coreUpgrade xml-commons-apisUpgrade glassfish-fastinfosetUpgrade xalan-j2Upgrade xml-commons-resolverUpgrade slf4jUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-runtimeUpgrade javassist-javadocUpgrade jackson-annotationsUpgrade xsomUpgrade relaxngDatatypeUpgrade stax-exUpgrade apache-commons-langUpgrade xerces-j2Upgrade bea-stax-apiUpgrade jakarta-commons-httpclientUpgrade python3-nssUpgrade javassistUpgrade jackson-databindUpgrade python-nss-docUpgrade jackson-jaxrs-providersUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-apiUpgrade slf4j-jdk14Upgrade velocityUpgrade jackson-jaxrs-json-providerUpgrade xmlstreambuffer | May 4, 2022 | Mar 18, 2020 |
| Centos_linux | — | Upgrade jackson-coreUpgrade pki-serverUpgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-runtimeUpgrade relaxngDatatypeUpgrade jackson-jaxrs-json-providerUpgrade pki-servlet-4.0-apiUpgrade jackson-annotationsUpgrade pki-base-javaUpgrade jss-debugsourceUpgrade pki-toolsUpgrade ldapjdkUpgrade stax-exUpgrade xmlstreambufferUpgrade xerces-j2Upgrade slf4j-jdk14Upgrade python3-pkiUpgrade apache-commons-langUpgrade resteasyUpgrade glassfish-fastinfosetUpgrade jackson-databindUpgrade slf4jUpgrade tomcatjssUpgrade jackson-jaxrs-providersUpgrade jackson-module-jaxb-annotationsUpgrade python3-nss-debuginfoUpgrade xalan-j2Upgrade pki-kraUpgrade xml-commons-apisUpgrade jss-javadocUpgrade glassfish-jaxb-coreUpgrade pki-baseUpgrade ldapjdk-javadocUpgrade pki-symkeyUpgrade velocityUpgrade glassfish-jaxb-txw2Upgrade pki-tools-debuginfoUpgrade javassistUpgrade python-nss-debugsourceUpgrade pki-servlet-engineUpgrade jss-debuginfoUpgrade pki-symkey-debuginfoUpgrade bea-stax-apiUpgrade apache-commons-collectionsUpgrade xml-commons-resolverUpgrade pki-caUpgrade jakarta-commons-httpclientUpgrade pki-core-debugsourceUpgrade python-nss-docUpgrade pki-core-debuginfoUpgrade python3-nssUpgrade jssUpgrade javassist-javadocUpgrade xsom | Sep 8, 2020 | Mar 18, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 23, 2020 | Mar 18, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 15, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 18, 2020 |
| Redhat_linux | — | Upgrade jakarta-commons-httpclientUpgrade pki-toolsUpgrade pki-symkey-debuginfoUpgrade jss-debugsourceUpgrade pki-symkeyUpgrade javassistUpgrade pki-caUpgrade javassist-javadocUpgrade glassfish-fastinfosetUpgrade slf4jUpgrade pki-base-javaUpgrade glassfish-jaxb-txw2Upgrade ldapjdk-javadocUpgrade python3-nssUpgrade pki-servlet-engineUpgrade jssUpgrade xsomUpgrade glassfish-jaxb-coreUpgrade python3-nss-debuginfoUpgrade glassfish-jaxb-apiUpgrade apache-commons-collectionsUpgrade jss-debuginfoUpgrade velocityUpgrade stax-exUpgrade python-nss-docUpgrade python-nss-debugsourceUpgrade apache-commons-langUpgrade jackson-module-jaxb-annotationsUpgrade jss-javadocUpgrade pki-core-debugsourceUpgrade resteasyUpgrade jackson-annotationsUpgrade jackson-jaxrs-json-providerUpgrade xerces-j2Upgrade jackson-jaxrs-providersUpgrade pki-core-debuginfoUpgrade python3-pkiUpgrade jackson-coreUpgrade pki-kraUpgrade bea-stax-apiUpgrade xml-commons-apisUpgrade pki-baseUpgrade pki-tools-debuginfoUpgrade slf4j-jdk14Upgrade xalan-j2Upgrade xmlstreambufferUpgrade ldapjdkUpgrade pki-serverUpgrade xml-commons-resolverUpgrade relaxngDatatypeUpgrade glassfish-jaxb-runtimeUpgrade jackson-databindUpgrade tomcatjssUpgrade pki-servlet-4.0-api | Sep 8, 2020 | Mar 18, 2020 |
| Rocky_linux | — | Upgrade python-nss-docUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfoUpgrade python3-nss | Mar 12, 2024 | Mar 18, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 18, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub