FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade glassfish-jaxb-coreUpgrade javassistUpgrade xsomUpgrade glassfish-jaxb-txw2Upgrade apache-commons-langUpgrade jakarta-commons-httpclientUpgrade xml-commons-resolverUpgrade glassfish-fastinfosetUpgrade relaxngDatatypeUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-apiUpgrade xalan-j2Upgrade javassist-javadocUpgrade jackson-annotationsUpgrade python3-nssUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-apisUpgrade bea-stax-apiUpgrade slf4jUpgrade jackson-jaxrs-json-providerUpgrade velocityUpgrade stax-exUpgrade xmlstreambufferUpgrade xerces-j2Upgrade jackson-coreUpgrade slf4j-jdk14Upgrade jackson-module-jaxb-annotationsUpgrade python-nss-docUpgrade jackson-databindUpgrade jackson-jaxrs-providers | May 13, 2022 | Feb 10, 2020 |
| Centos_linux | — | Upgrade jackson-annotationsUpgrade jackson-coreUpgrade jss-javadocUpgrade jackson-jaxrs-providersUpgrade slf4jUpgrade xml-commons-resolverUpgrade jackson-jaxrs-json-providerUpgrade pki-toolsUpgrade python3-pkiUpgrade xerces-j2Upgrade apache-commons-langUpgrade slf4j-jdk14Upgrade glassfish-jaxb-runtimeUpgrade velocityUpgrade pki-tools-debuginfoUpgrade resteasyUpgrade python3-nss-debuginfoUpgrade xalan-j2Upgrade pki-serverUpgrade pki-kraUpgrade jackson-module-jaxb-annotationsUpgrade jackson-databindUpgrade tomcatjssUpgrade ldapjdkUpgrade jss-debugsourceUpgrade relaxngDatatypeUpgrade xmlstreambufferUpgrade xml-commons-apisUpgrade stax-exUpgrade pki-servlet-4.0-apiUpgrade pki-core-debugsourceUpgrade pki-servlet-engineUpgrade pki-symkey-debuginfoUpgrade jss-debuginfoUpgrade glassfish-fastinfosetUpgrade pki-baseUpgrade xsomUpgrade javassistUpgrade jakarta-commons-httpclientUpgrade jssUpgrade apache-commons-collectionsUpgrade python-nss-docUpgrade glassfish-jaxb-coreUpgrade python-nss-debugsourceUpgrade pki-symkeyUpgrade javassist-javadocUpgrade pki-core-debuginfoUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-apiUpgrade ldapjdk-javadocUpgrade bea-stax-apiUpgrade pki-caUpgrade pki-base-javaUpgrade python3-nss | Oct 4, 2021 | Feb 10, 2020 |
| Debian | — | Upgrade jackson-databind | Feb 24, 2020 | Feb 10, 2020 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 24, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 2, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Feb 10, 2020 |
| Redhat_linux | — | Upgrade python-nss-docUpgrade relaxngDatatypeUpgrade python-nss-debugsourceUpgrade stax-exUpgrade jackson-annotationsUpgrade apache-commons-collectionsUpgrade pki-base-javaUpgrade pki-toolsUpgrade glassfish-jaxb-apiUpgrade javassistUpgrade jss-debuginfoUpgrade glassfish-fastinfosetUpgrade pki-kraUpgrade jackson-jaxrs-providersUpgrade pki-symkey-debuginfoUpgrade slf4j-jdk14Upgrade bea-stax-apiUpgrade slf4jUpgrade jakarta-commons-httpclientUpgrade pki-symkeyUpgrade velocityUpgrade pki-serverUpgrade pki-servlet-engineUpgrade ldapjdk-javadocUpgrade xml-commons-resolverUpgrade pki-baseUpgrade pki-core-debuginfoUpgrade xmlstreambufferUpgrade glassfish-jaxb-runtimeUpgrade pki-tools-debuginfoUpgrade glassfish-jaxb-txw2Upgrade python3-pkiUpgrade ldapjdkUpgrade jackson-coreUpgrade xerces-j2Upgrade jackson-databindUpgrade pki-caUpgrade xsomUpgrade jss-debugsourceUpgrade xalan-j2Upgrade tomcatjssUpgrade jackson-module-jaxb-annotationsUpgrade jackson-jaxrs-json-providerUpgrade apache-commons-langUpgrade xml-commons-apisUpgrade python3-nssUpgrade glassfish-jaxb-coreUpgrade jss-javadocUpgrade pki-core-debugsourceUpgrade python3-nss-debuginfoUpgrade pki-servlet-4.0-apiUpgrade resteasyUpgrade jssUpgrade javassist-javadoc | Oct 4, 2021 | Feb 10, 2020 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-debugsourceUpgrade python-nss-docUpgrade python3-nss-debuginfo | Mar 12, 2024 | Feb 10, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Feb 10, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub