FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xerces-j2Upgrade glassfish-jaxb-txw2Upgrade xmlstreambufferUpgrade xalan-j2Upgrade jackson-jaxrs-json-providerUpgrade glassfish-fastinfosetUpgrade jackson-databindUpgrade xml-commons-apisUpgrade apache-commons-langUpgrade glassfish-jaxb-apiUpgrade javassist-javadocUpgrade jackson-annotationsUpgrade relaxngDatatypeUpgrade slf4jUpgrade jakarta-commons-httpclientUpgrade xml-commons-resolverUpgrade xsomUpgrade javassistUpgrade jackson-module-jaxb-annotationsUpgrade velocityUpgrade python-nss-docUpgrade jackson-jaxrs-providersUpgrade jackson-coreUpgrade glassfish-jaxb-coreUpgrade bea-stax-apiUpgrade python3-nssUpgrade slf4j-jdk14Upgrade apache-commons-collectionsUpgrade glassfish-jaxb-runtimeUpgrade stax-ex | May 4, 2022 | Mar 18, 2020 |
| Centos_linux | — | Upgrade python3-nss-debuginfoUpgrade pki-caUpgrade pki-servlet-4.0-apiUpgrade tomcatjssUpgrade pki-core-debugsourceUpgrade jakarta-commons-httpclientUpgrade jackson-databindUpgrade slf4jUpgrade xml-commons-apisUpgrade python-nss-debugsourceUpgrade jss-debugsourceUpgrade relaxngDatatypeUpgrade javassist-javadocUpgrade jackson-module-jaxb-annotationsUpgrade xml-commons-resolverUpgrade glassfish-jaxb-runtimeUpgrade python3-pkiUpgrade pki-toolsUpgrade pki-serverUpgrade pki-core-debuginfoUpgrade pki-base-javaUpgrade jackson-annotationsUpgrade javassistUpgrade jss-javadocUpgrade pki-baseUpgrade glassfish-fastinfosetUpgrade xsomUpgrade glassfish-jaxb-coreUpgrade apache-commons-langUpgrade xalan-j2Upgrade resteasyUpgrade glassfish-jaxb-txw2Upgrade stax-exUpgrade glassfish-jaxb-apiUpgrade xerces-j2Upgrade python-nss-docUpgrade pki-tools-debuginfoUpgrade jackson-coreUpgrade velocityUpgrade jackson-jaxrs-providersUpgrade python3-nssUpgrade pki-servlet-engineUpgrade pki-kraUpgrade jssUpgrade pki-symkeyUpgrade xmlstreambufferUpgrade jss-debuginfoUpgrade jackson-jaxrs-json-providerUpgrade ldapjdk-javadocUpgrade ldapjdkUpgrade bea-stax-apiUpgrade apache-commons-collectionsUpgrade pki-symkey-debuginfoUpgrade slf4j-jdk14 | Sep 8, 2020 | Mar 18, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 23, 2020 | Mar 18, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 18, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 18, 2020 |
| Redhat_linux | — | Upgrade xml-commons-resolverUpgrade javassistUpgrade pki-core-debuginfoUpgrade pki-caUpgrade jackson-databindUpgrade jssUpgrade glassfish-jaxb-runtimeUpgrade python3-nssUpgrade jackson-jaxrs-json-providerUpgrade xsomUpgrade xmlstreambufferUpgrade xerces-j2Upgrade pki-base-javaUpgrade glassfish-jaxb-coreUpgrade javassist-javadocUpgrade pki-servlet-4.0-apiUpgrade glassfish-fastinfosetUpgrade pki-symkeyUpgrade xalan-j2Upgrade python-nss-docUpgrade glassfish-jaxb-txw2Upgrade pki-tools-debuginfoUpgrade bea-stax-apiUpgrade pki-core-debugsourceUpgrade pki-baseUpgrade apache-commons-collectionsUpgrade ldapjdkUpgrade pki-symkey-debuginfoUpgrade jackson-module-jaxb-annotationsUpgrade pki-serverUpgrade pki-servlet-engineUpgrade stax-exUpgrade pki-toolsUpgrade jackson-annotationsUpgrade relaxngDatatypeUpgrade jss-debuginfoUpgrade pki-kraUpgrade jss-debugsourceUpgrade ldapjdk-javadocUpgrade jss-javadocUpgrade python3-pkiUpgrade apache-commons-langUpgrade python-nss-debugsourceUpgrade slf4jUpgrade xml-commons-apisUpgrade tomcatjssUpgrade glassfish-jaxb-apiUpgrade velocityUpgrade slf4j-jdk14Upgrade jakarta-commons-httpclientUpgrade jackson-jaxrs-providersUpgrade python3-nss-debuginfoUpgrade resteasyUpgrade jackson-core | Sep 8, 2020 | Mar 18, 2020 |
| Rocky_linux | — | Upgrade python-nss-debugsourceUpgrade python3-nssUpgrade python-nss-docUpgrade python3-nss-debuginfo | Mar 12, 2024 | Mar 18, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 18, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub