FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-runtimeUpgrade python-nss-docUpgrade slf4j-jdk14Upgrade jackson-jaxrs-providersUpgrade python3-nssUpgrade stax-exUpgrade apache-commons-collectionsUpgrade jackson-coreUpgrade bea-stax-apiUpgrade velocityUpgrade xalan-j2Upgrade apache-commons-langUpgrade glassfish-fastinfosetUpgrade xml-commons-apisUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-apiUpgrade jackson-databindUpgrade glassfish-jaxb-txw2Upgrade xsomUpgrade slf4jUpgrade jackson-annotationsUpgrade jackson-module-jaxb-annotationsUpgrade xml-commons-resolverUpgrade javassistUpgrade javassist-javadocUpgrade relaxngDatatypeUpgrade jackson-jaxrs-json-providerUpgrade xmlstreambufferUpgrade xerces-j2 | May 4, 2022 | Mar 18, 2020 |
| Centos_linux | — | Upgrade velocityUpgrade jssUpgrade stax-exUpgrade jackson-jaxrs-providersUpgrade python3-nssUpgrade glassfish-jaxb-apiUpgrade jackson-jaxrs-json-providerUpgrade bea-stax-apiUpgrade ldapjdk-javadocUpgrade pki-symkey-debuginfoUpgrade apache-commons-collectionsUpgrade pki-symkeyUpgrade xmlstreambufferUpgrade pki-servlet-engineUpgrade jss-debuginfoUpgrade ldapjdkUpgrade jackson-coreUpgrade pki-tools-debuginfoUpgrade python-nss-docUpgrade xerces-j2Upgrade slf4j-jdk14Upgrade pki-kraUpgrade pki-core-debuginfoUpgrade pki-baseUpgrade jackson-databindUpgrade javassistUpgrade xsomUpgrade jss-javadocUpgrade javassist-javadocUpgrade jakarta-commons-httpclientUpgrade jackson-module-jaxb-annotationsUpgrade relaxngDatatypeUpgrade python3-pkiUpgrade pki-serverUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-txw2Upgrade pki-toolsUpgrade resteasyUpgrade xml-commons-apisUpgrade pki-core-debugsourceUpgrade python3-nss-debuginfoUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-resolverUpgrade slf4jUpgrade glassfish-jaxb-coreUpgrade xalan-j2Upgrade python-nss-debugsourceUpgrade pki-base-javaUpgrade tomcatjssUpgrade pki-caUpgrade jackson-annotationsUpgrade jss-debugsourceUpgrade glassfish-fastinfosetUpgrade apache-commons-lang | Sep 8, 2020 | Mar 18, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 23, 2020 | Mar 18, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 18, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 18, 2020 |
| Redhat_linux | — | Upgrade python-nss-debugsourceUpgrade slf4jUpgrade jss-javadocUpgrade glassfish-jaxb-apiUpgrade jakarta-commons-httpclientUpgrade python3-pkiUpgrade jackson-annotationsUpgrade slf4j-jdk14Upgrade pki-servlet-engineUpgrade ldapjdk-javadocUpgrade xml-commons-apisUpgrade pki-symkey-debuginfoUpgrade jackson-module-jaxb-annotationsUpgrade tomcatjssUpgrade apache-commons-langUpgrade jackson-coreUpgrade pki-kraUpgrade jackson-jaxrs-providersUpgrade jss-debuginfoUpgrade velocityUpgrade pki-serverUpgrade pki-toolsUpgrade python3-nss-debuginfoUpgrade stax-exUpgrade relaxngDatatypeUpgrade resteasyUpgrade jss-debugsourceUpgrade glassfish-fastinfosetUpgrade jssUpgrade xml-commons-resolverUpgrade python3-nssUpgrade pki-base-javaUpgrade pki-caUpgrade javassistUpgrade pki-baseUpgrade python-nss-docUpgrade bea-stax-apiUpgrade xmlstreambufferUpgrade xsomUpgrade glassfish-jaxb-coreUpgrade xerces-j2Upgrade pki-core-debuginfoUpgrade glassfish-jaxb-runtimeUpgrade pki-servlet-4.0-apiUpgrade jackson-jaxrs-json-providerUpgrade jackson-databindUpgrade javassist-javadocUpgrade pki-core-debugsourceUpgrade apache-commons-collectionsUpgrade pki-symkeyUpgrade ldapjdkUpgrade pki-tools-debuginfoUpgrade glassfish-jaxb-txw2Upgrade xalan-j2 | Sep 8, 2020 | Mar 18, 2020 |
| Rocky_linux | — | Upgrade python-nss-docUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade python3-nss | Mar 12, 2024 | Mar 18, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 18, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub