FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-nssUpgrade slf4j-jdk14Upgrade apache-commons-collectionsUpgrade bea-stax-apiUpgrade velocityUpgrade stax-exUpgrade glassfish-jaxb-coreUpgrade python-nss-docUpgrade jackson-coreUpgrade glassfish-jaxb-runtimeUpgrade jackson-jaxrs-providersUpgrade relaxngDatatypeUpgrade javassistUpgrade xalan-j2Upgrade glassfish-jaxb-txw2Upgrade javassist-javadocUpgrade slf4jUpgrade glassfish-jaxb-apiUpgrade jackson-databindUpgrade xml-commons-apisUpgrade xerces-j2Upgrade apache-commons-langUpgrade jakarta-commons-httpclientUpgrade jackson-jaxrs-json-providerUpgrade xsomUpgrade jackson-module-jaxb-annotationsUpgrade jackson-annotationsUpgrade glassfish-fastinfosetUpgrade xml-commons-resolverUpgrade xmlstreambuffer | May 4, 2022 | Mar 18, 2020 |
| Centos_linux | — | Upgrade xalan-j2Upgrade xsomUpgrade apache-commons-langUpgrade pki-baseUpgrade glassfish-fastinfosetUpgrade pki-core-debuginfoUpgrade glassfish-jaxb-coreUpgrade jss-javadocUpgrade jss-debugsourceUpgrade python3-nss-debuginfoUpgrade glassfish-jaxb-runtimeUpgrade pki-toolsUpgrade pki-core-debugsourceUpgrade xml-commons-apisUpgrade tomcatjssUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-txw2Upgrade slf4jUpgrade javassist-javadocUpgrade jackson-databindUpgrade javassistUpgrade python-nss-debugsourceUpgrade jackson-annotationsUpgrade relaxngDatatypeUpgrade jackson-module-jaxb-annotationsUpgrade pki-serverUpgrade jakarta-commons-httpclientUpgrade pki-caUpgrade python3-pkiUpgrade pki-base-javaUpgrade xml-commons-resolverUpgrade resteasyUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-apiUpgrade pki-servlet-engineUpgrade pki-symkeyUpgrade bea-stax-apiUpgrade slf4j-jdk14Upgrade pki-symkey-debuginfoUpgrade jss-debuginfoUpgrade jackson-jaxrs-json-providerUpgrade ldapjdkUpgrade xmlstreambufferUpgrade ldapjdk-javadocUpgrade pki-kraUpgrade xerces-j2Upgrade python-nss-docUpgrade pki-tools-debuginfoUpgrade jackson-coreUpgrade jackson-jaxrs-providersUpgrade jssUpgrade stax-exUpgrade velocityUpgrade python3-nss | Sep 8, 2020 | Mar 18, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 23, 2020 | Mar 18, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 18, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 18, 2020 |
| Redhat_linux | — | Upgrade xsomUpgrade javassistUpgrade ldapjdkUpgrade pki-core-debuginfoUpgrade glassfish-fastinfosetUpgrade pki-caUpgrade python-nss-docUpgrade jackson-jaxrs-json-providerUpgrade xerces-j2Upgrade pki-base-javaUpgrade jssUpgrade glassfish-jaxb-txw2Upgrade pki-core-debugsourceUpgrade glassfish-jaxb-coreUpgrade pki-baseUpgrade jackson-databindUpgrade bea-stax-apiUpgrade apache-commons-collectionsUpgrade javassist-javadocUpgrade xml-commons-resolverUpgrade pki-tools-debuginfoUpgrade xalan-j2Upgrade pki-servlet-4.0-apiUpgrade xmlstreambufferUpgrade pki-symkeyUpgrade python3-nssUpgrade glassfish-jaxb-runtimeUpgrade slf4j-jdk14Upgrade tomcatjssUpgrade jackson-jaxrs-providersUpgrade jss-debuginfoUpgrade pki-kraUpgrade python3-pkiUpgrade jakarta-commons-httpclientUpgrade jackson-annotationsUpgrade python-nss-debugsourceUpgrade ldapjdk-javadocUpgrade jackson-module-jaxb-annotationsUpgrade pki-serverUpgrade velocityUpgrade pki-symkey-debuginfoUpgrade pki-servlet-engineUpgrade apache-commons-langUpgrade slf4jUpgrade xml-commons-apisUpgrade relaxngDatatypeUpgrade jss-javadocUpgrade jss-debugsourceUpgrade glassfish-jaxb-apiUpgrade pki-toolsUpgrade resteasyUpgrade jackson-coreUpgrade python3-nss-debuginfoUpgrade stax-ex | Sep 8, 2020 | Mar 18, 2020 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfoUpgrade python-nss-doc | Mar 12, 2024 | Mar 18, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 18, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub