FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-coreUpgrade glassfish-jaxb-runtimeUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-coreUpgrade slf4jUpgrade relaxngDatatypeUpgrade xsomUpgrade glassfish-fastinfosetUpgrade xml-commons-resolverUpgrade xalan-j2Upgrade javassist-javadocUpgrade jackson-annotationsUpgrade xml-commons-apisUpgrade jackson-jaxrs-json-providerUpgrade jakarta-commons-httpclientUpgrade python3-nssUpgrade slf4j-jdk14Upgrade glassfish-jaxb-apiUpgrade python-nss-docUpgrade apache-commons-collectionsUpgrade jackson-databindUpgrade javassistUpgrade bea-stax-apiUpgrade apache-commons-langUpgrade stax-exUpgrade xmlstreambufferUpgrade xerces-j2Upgrade jackson-jaxrs-providersUpgrade velocity | May 4, 2022 | Mar 18, 2020 |
| Centos_linux | — | Upgrade pki-symkey-debuginfoUpgrade python3-nssUpgrade pki-symkeyUpgrade xsomUpgrade glassfish-jaxb-txw2Upgrade python-nss-debugsourceUpgrade javassistUpgrade pki-core-debuginfoUpgrade pki-core-debugsourceUpgrade pki-tools-debuginfoUpgrade pki-baseUpgrade python-nss-docUpgrade bea-stax-apiUpgrade apache-commons-collectionsUpgrade pki-caUpgrade jss-debuginfoUpgrade velocityUpgrade xml-commons-resolverUpgrade glassfish-jaxb-coreUpgrade pki-servlet-engineUpgrade ldapjdk-javadocUpgrade javassist-javadocUpgrade jakarta-commons-httpclientUpgrade jssUpgrade xmlstreambufferUpgrade pki-toolsUpgrade jackson-coreUpgrade stax-exUpgrade relaxngDatatypeUpgrade xalan-j2Upgrade jss-debugsourceUpgrade xerces-j2Upgrade glassfish-fastinfosetUpgrade slf4jUpgrade jackson-jaxrs-providersUpgrade jackson-module-jaxb-annotationsUpgrade slf4j-jdk14Upgrade python3-pkiUpgrade apache-commons-langUpgrade python3-nss-debuginfoUpgrade jss-javadocUpgrade xml-commons-apisUpgrade pki-servlet-4.0-apiUpgrade jackson-jaxrs-json-providerUpgrade pki-base-javaUpgrade tomcatjssUpgrade ldapjdkUpgrade pki-kraUpgrade jackson-annotationsUpgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-runtimeUpgrade pki-serverUpgrade jackson-databindUpgrade resteasy | Sep 8, 2020 | Mar 18, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 23, 2020 | Mar 18, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 15, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 18, 2020 |
| Redhat_linux | — | Upgrade xerces-j2Upgrade jackson-module-jaxb-annotationsUpgrade pki-core-debugsourceUpgrade ldapjdkUpgrade apache-commons-langUpgrade pki-serverUpgrade xmlstreambufferUpgrade xml-commons-apisUpgrade jackson-jaxrs-json-providerUpgrade jackson-annotationsUpgrade pki-kraUpgrade xalan-j2Upgrade glassfish-jaxb-runtimeUpgrade jackson-databindUpgrade relaxngDatatypeUpgrade tomcatjssUpgrade pki-core-debuginfoUpgrade jackson-jaxrs-providersUpgrade jackson-coreUpgrade python3-pkiUpgrade pki-servlet-4.0-apiUpgrade resteasyUpgrade pki-tools-debuginfoUpgrade slf4j-jdk14Upgrade pki-baseUpgrade xml-commons-resolverUpgrade jss-javadocUpgrade bea-stax-apiUpgrade pki-symkey-debuginfoUpgrade glassfish-jaxb-apiUpgrade glassfish-fastinfosetUpgrade slf4jUpgrade glassfish-jaxb-coreUpgrade python-nss-docUpgrade pki-servlet-engineUpgrade python-nss-debugsourceUpgrade pki-toolsUpgrade velocityUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-txw2Upgrade javassist-javadocUpgrade jss-debuginfoUpgrade stax-exUpgrade pki-symkeyUpgrade python3-nssUpgrade pki-caUpgrade ldapjdk-javadocUpgrade javassistUpgrade jss-debugsourceUpgrade pki-base-javaUpgrade jssUpgrade apache-commons-collectionsUpgrade python3-nss-debuginfoUpgrade xsom | Sep 8, 2020 | Mar 18, 2020 |
| Rocky_linux | — | Upgrade python-nss-docUpgrade python-nss-debugsourceUpgrade python3-nssUpgrade python3-nss-debuginfo | Mar 12, 2024 | Mar 18, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 18, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub