FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade relaxngDatatypeUpgrade jackson-annotationsUpgrade xalan-j2Upgrade glassfish-fastinfosetUpgrade jackson-jaxrs-json-providerUpgrade javassistUpgrade glassfish-jaxb-txw2Upgrade apache-commons-langUpgrade slf4jUpgrade xerces-j2Upgrade xsomUpgrade xml-commons-apisUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-apiUpgrade xml-commons-resolverUpgrade jakarta-commons-httpclientUpgrade javassist-javadocUpgrade jackson-databindUpgrade xmlstreambufferUpgrade python-nss-docUpgrade python3-nssUpgrade velocityUpgrade jackson-coreUpgrade glassfish-jaxb-coreUpgrade jackson-jaxrs-providersUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-runtimeUpgrade bea-stax-apiUpgrade slf4j-jdk14Upgrade stax-ex | May 4, 2022 | Mar 18, 2020 |
| Centos_linux | — | Upgrade python3-nssUpgrade stax-exUpgrade pki-kraUpgrade ldapjdkUpgrade jss-debuginfoUpgrade xmlstreambufferUpgrade jssUpgrade velocityUpgrade pki-servlet-engineUpgrade jackson-jaxrs-providersUpgrade bea-stax-apiUpgrade glassfish-jaxb-apiUpgrade ldapjdk-javadocUpgrade jackson-jaxrs-json-providerUpgrade slf4j-jdk14Upgrade pki-tools-debuginfoUpgrade pki-symkey-debuginfoUpgrade pki-symkeyUpgrade jackson-coreUpgrade python-nss-docUpgrade xerces-j2Upgrade apache-commons-collectionsUpgrade xsomUpgrade xalan-j2Upgrade pki-servlet-4.0-apiUpgrade python-nss-debugsourceUpgrade relaxngDatatypeUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-txw2Upgrade jss-debugsourceUpgrade pki-caUpgrade pki-toolsUpgrade pki-core-debuginfoUpgrade resteasyUpgrade glassfish-jaxb-coreUpgrade apache-commons-langUpgrade jss-javadocUpgrade glassfish-fastinfosetUpgrade javassistUpgrade slf4jUpgrade xml-commons-resolverUpgrade jackson-databindUpgrade python3-nss-debuginfoUpgrade pki-core-debugsourceUpgrade pki-baseUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-apisUpgrade javassist-javadocUpgrade tomcatjssUpgrade pki-serverUpgrade jackson-annotationsUpgrade jakarta-commons-httpclientUpgrade python3-pkiUpgrade pki-base-java | Sep 8, 2020 | Mar 18, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 23, 2020 | Mar 18, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 18, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 18, 2020 |
| Redhat_linux | — | Upgrade jackson-databindUpgrade javassistUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-txw2Upgrade ldapjdkUpgrade glassfish-fastinfosetUpgrade pki-core-debuginfoUpgrade pki-core-debugsourceUpgrade python-nss-docUpgrade bea-stax-apiUpgrade apache-commons-collectionsUpgrade pki-symkeyUpgrade xmlstreambufferUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-runtimeUpgrade javassist-javadocUpgrade pki-servlet-4.0-apiUpgrade pki-baseUpgrade xerces-j2Upgrade pki-caUpgrade xsomUpgrade pki-tools-debuginfoUpgrade jssUpgrade xalan-j2Upgrade pki-base-javaUpgrade xml-commons-resolverUpgrade python3-nssUpgrade pki-servlet-engineUpgrade pki-toolsUpgrade pki-symkey-debuginfoUpgrade pki-serverUpgrade velocityUpgrade jackson-coreUpgrade python-nss-debugsourceUpgrade apache-commons-langUpgrade python3-nss-debuginfoUpgrade stax-exUpgrade relaxngDatatypeUpgrade xml-commons-apisUpgrade tomcatjssUpgrade glassfish-jaxb-apiUpgrade ldapjdk-javadocUpgrade slf4j-jdk14Upgrade jakarta-commons-httpclientUpgrade pki-kraUpgrade jackson-jaxrs-providersUpgrade jss-debuginfoUpgrade jackson-annotationsUpgrade jackson-module-jaxb-annotationsUpgrade resteasyUpgrade slf4jUpgrade jss-debugsourceUpgrade python3-pkiUpgrade jss-javadoc | Sep 8, 2020 | Mar 18, 2020 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-debugsourceUpgrade python-nss-docUpgrade python3-nss-debuginfo | Mar 12, 2024 | Mar 18, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 18, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub