FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-runtimeUpgrade slf4jUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-coreUpgrade jackson-coreUpgrade glassfish-fastinfosetUpgrade xml-commons-resolverUpgrade javassist-javadocUpgrade xalan-j2Upgrade relaxngDatatypeUpgrade jackson-annotationsUpgrade xml-commons-apisUpgrade xsomUpgrade xerces-j2Upgrade javassistUpgrade stax-exUpgrade xmlstreambufferUpgrade python3-nssUpgrade jakarta-commons-httpclientUpgrade bea-stax-apiUpgrade velocityUpgrade jackson-jaxrs-json-providerUpgrade jackson-databindUpgrade glassfish-jaxb-apiUpgrade slf4j-jdk14Upgrade jackson-jaxrs-providersUpgrade python-nss-docUpgrade apache-commons-collectionsUpgrade apache-commons-lang | May 4, 2022 | Mar 18, 2020 |
| Centos_linux | — | Upgrade glassfish-jaxb-txw2Upgrade xsomUpgrade velocityUpgrade glassfish-jaxb-coreUpgrade javassist-javadocUpgrade python-nss-docUpgrade pki-core-debuginfoUpgrade python-nss-debugsourceUpgrade pki-symkey-debuginfoUpgrade pki-core-debugsourceUpgrade javassistUpgrade pki-servlet-engineUpgrade ldapjdk-javadocUpgrade xml-commons-resolverUpgrade apache-commons-collectionsUpgrade python3-nssUpgrade pki-caUpgrade bea-stax-apiUpgrade jakarta-commons-httpclientUpgrade jss-debuginfoUpgrade pki-tools-debuginfoUpgrade pki-symkeyUpgrade jssUpgrade pki-baseUpgrade python3-nss-debuginfoUpgrade apache-commons-langUpgrade resteasyUpgrade slf4jUpgrade pki-kraUpgrade glassfish-jaxb-runtimeUpgrade pki-serverUpgrade jackson-coreUpgrade jackson-annotationsUpgrade jackson-jaxrs-json-providerUpgrade jackson-jaxrs-providersUpgrade jackson-module-jaxb-annotationsUpgrade ldapjdkUpgrade pki-base-javaUpgrade jss-javadocUpgrade xerces-j2Upgrade xml-commons-apisUpgrade xmlstreambufferUpgrade python3-pkiUpgrade slf4j-jdk14Upgrade glassfish-jaxb-apiUpgrade stax-exUpgrade relaxngDatatypeUpgrade pki-toolsUpgrade jackson-databindUpgrade xalan-j2Upgrade tomcatjssUpgrade jss-debugsourceUpgrade pki-servlet-4.0-apiUpgrade glassfish-fastinfoset | Sep 8, 2020 | Mar 18, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 23, 2020 | Mar 18, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 15, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 18, 2020 |
| Redhat_linux | — | Upgrade jackson-jaxrs-providersUpgrade jackson-annotationsUpgrade xerces-j2Upgrade pki-core-debuginfoUpgrade jackson-databindUpgrade pki-servlet-4.0-apiUpgrade apache-commons-langUpgrade ldapjdkUpgrade pki-baseUpgrade resteasyUpgrade jackson-module-jaxb-annotationsUpgrade pki-serverUpgrade pki-tools-debuginfoUpgrade python3-pkiUpgrade jackson-jaxrs-json-providerUpgrade tomcatjssUpgrade glassfish-jaxb-runtimeUpgrade relaxngDatatypeUpgrade xml-commons-resolverUpgrade xalan-j2Upgrade xml-commons-apisUpgrade slf4j-jdk14Upgrade jackson-coreUpgrade pki-core-debugsourceUpgrade pki-kraUpgrade xmlstreambufferUpgrade jss-javadocUpgrade bea-stax-apiUpgrade python-nss-docUpgrade jss-debugsourceUpgrade ldapjdk-javadocUpgrade xsomUpgrade python-nss-debugsourceUpgrade pki-symkeyUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-apiUpgrade javassistUpgrade pki-symkey-debuginfoUpgrade javassist-javadocUpgrade glassfish-jaxb-coreUpgrade pki-toolsUpgrade velocityUpgrade pki-caUpgrade pki-base-javaUpgrade jssUpgrade pki-servlet-engineUpgrade slf4jUpgrade python3-nss-debuginfoUpgrade apache-commons-collectionsUpgrade glassfish-fastinfosetUpgrade jss-debuginfoUpgrade stax-exUpgrade glassfish-jaxb-txw2Upgrade python3-nss | Sep 8, 2020 | Mar 18, 2020 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python3-nss-debuginfoUpgrade python-nss-docUpgrade python-nss-debugsource | Mar 12, 2024 | Mar 18, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 18, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub