FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade glassfish-jaxb-apiUpgrade xsomUpgrade glassfish-fastinfosetUpgrade javassist-javadocUpgrade relaxngDatatypeUpgrade apache-commons-langUpgrade glassfish-jaxb-coreUpgrade jakarta-commons-httpclientUpgrade javassistUpgrade xalan-j2Upgrade apache-commons-collectionsUpgrade xml-commons-resolverUpgrade glassfish-jaxb-txw2Upgrade xmlstreambufferUpgrade bea-stax-apiUpgrade jackson-module-jaxb-annotationsUpgrade python-nss-docUpgrade jackson-databindUpgrade xerces-j2Upgrade velocityUpgrade glassfish-jaxb-runtimeUpgrade slf4j-jdk14Upgrade jackson-coreUpgrade stax-exUpgrade jackson-jaxrs-providersUpgrade jackson-jaxrs-json-providerUpgrade slf4jUpgrade xml-commons-apisUpgrade python3-nssUpgrade jackson-annotations | May 13, 2022 | Feb 10, 2020 |
| Centos_linux | — | Upgrade javassist-javadocUpgrade pki-symkeyUpgrade jakarta-commons-httpclientUpgrade apache-commons-collectionsUpgrade jssUpgrade glassfish-jaxb-txw2Upgrade python-nss-debugsourceUpgrade glassfish-jaxb-apiUpgrade pki-baseUpgrade xsomUpgrade bea-stax-apiUpgrade pki-core-debugsourceUpgrade python3-nssUpgrade ldapjdk-javadocUpgrade glassfish-jaxb-coreUpgrade jss-debuginfoUpgrade pki-base-javaUpgrade pki-servlet-engineUpgrade python-nss-docUpgrade javassistUpgrade pki-core-debuginfoUpgrade pki-caUpgrade pki-symkey-debuginfoUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-runtimeUpgrade python3-nss-debuginfoUpgrade pki-kraUpgrade resteasyUpgrade xerces-j2Upgrade jss-javadocUpgrade xmlstreambufferUpgrade tomcatjssUpgrade pki-tools-debuginfoUpgrade jss-debugsourceUpgrade ldapjdkUpgrade pki-serverUpgrade velocityUpgrade relaxngDatatypeUpgrade pki-servlet-4.0-apiUpgrade stax-exUpgrade jackson-coreUpgrade jackson-annotationsUpgrade apache-commons-langUpgrade jackson-jaxrs-json-providerUpgrade slf4jUpgrade pki-toolsUpgrade jackson-jaxrs-providersUpgrade slf4j-jdk14Upgrade xml-commons-resolverUpgrade xml-commons-apisUpgrade python3-pkiUpgrade xalan-j2Upgrade jackson-databindUpgrade jackson-module-jaxb-annotations | Oct 4, 2021 | Feb 10, 2020 |
| Debian | — | Upgrade jackson-databind | Feb 24, 2020 | Feb 10, 2020 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 24, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 2, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Feb 10, 2020 |
| Redhat_linux | — | Upgrade apache-commons-langUpgrade jackson-databindUpgrade python3-nss-debuginfoUpgrade pki-baseUpgrade glassfish-jaxb-coreUpgrade jackson-coreUpgrade resteasyUpgrade xml-commons-apisUpgrade xerces-j2Upgrade glassfish-jaxb-txw2Upgrade jackson-jaxrs-json-providerUpgrade jackson-module-jaxb-annotationsUpgrade jss-javadocUpgrade glassfish-jaxb-runtimeUpgrade pki-servlet-4.0-apiUpgrade jssUpgrade pki-caUpgrade pki-tools-debuginfoUpgrade xmlstreambufferUpgrade ldapjdkUpgrade jss-debugsourceUpgrade javassist-javadocUpgrade xalan-j2Upgrade pki-core-debuginfoUpgrade xsomUpgrade xml-commons-resolverUpgrade python3-nssUpgrade pki-core-debugsourceUpgrade tomcatjssUpgrade python3-pkiUpgrade stax-exUpgrade pki-serverUpgrade ldapjdk-javadocUpgrade pki-toolsUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-apiUpgrade relaxngDatatypeUpgrade apache-commons-collectionsUpgrade jss-debuginfoUpgrade python-nss-debugsourceUpgrade javassistUpgrade pki-kraUpgrade jakarta-commons-httpclientUpgrade python-nss-docUpgrade pki-symkey-debuginfoUpgrade pki-base-javaUpgrade velocityUpgrade pki-servlet-engineUpgrade bea-stax-apiUpgrade slf4j-jdk14Upgrade pki-symkeyUpgrade jackson-jaxrs-providersUpgrade jackson-annotationsUpgrade slf4j | Oct 4, 2021 | Feb 10, 2020 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-debugsourceUpgrade python-nss-docUpgrade python3-nss-debuginfo | Mar 12, 2024 | Feb 10, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Feb 10, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub