FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xerces-j2Upgrade xml-commons-apisUpgrade bea-stax-apiUpgrade python-nss-docUpgrade slf4j-jdk14Upgrade slf4jUpgrade jackson-jaxrs-json-providerUpgrade stax-exUpgrade xmlstreambufferUpgrade jackson-annotationsUpgrade python3-nssUpgrade jackson-module-jaxb-annotationsUpgrade jackson-coreUpgrade jackson-databindUpgrade glassfish-jaxb-runtimeUpgrade jackson-jaxrs-providersUpgrade velocityUpgrade javassistUpgrade apache-commons-collectionsUpgrade xalan-j2Upgrade javassist-javadocUpgrade jakarta-commons-httpclientUpgrade xml-commons-resolverUpgrade xsomUpgrade glassfish-fastinfosetUpgrade relaxngDatatypeUpgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-coreUpgrade apache-commons-langUpgrade glassfish-jaxb-txw2 | May 13, 2022 | Feb 10, 2020 |
| Centos_linux | — | Upgrade slf4jUpgrade jackson-jaxrs-json-providerUpgrade pki-toolsUpgrade pki-servlet-4.0-apiUpgrade relaxngDatatypeUpgrade stax-exUpgrade jackson-jaxrs-providersUpgrade xml-commons-resolverUpgrade velocityUpgrade jackson-annotationsUpgrade resteasyUpgrade xalan-j2Upgrade jackson-module-jaxb-annotationsUpgrade jss-javadocUpgrade xerces-j2Upgrade apache-commons-langUpgrade pki-kraUpgrade jackson-coreUpgrade xmlstreambufferUpgrade python3-nss-debuginfoUpgrade python3-pkiUpgrade ldapjdkUpgrade jackson-databindUpgrade slf4j-jdk14Upgrade xml-commons-apisUpgrade tomcatjssUpgrade glassfish-jaxb-runtimeUpgrade jss-debugsourceUpgrade pki-serverUpgrade pki-tools-debuginfoUpgrade apache-commons-collectionsUpgrade ldapjdk-javadocUpgrade python-nss-docUpgrade pki-base-javaUpgrade pki-caUpgrade xsomUpgrade python3-nssUpgrade pki-core-debugsourceUpgrade pki-baseUpgrade pki-servlet-engineUpgrade bea-stax-apiUpgrade pki-core-debuginfoUpgrade javassist-javadocUpgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-coreUpgrade javassistUpgrade python-nss-debugsourceUpgrade pki-symkeyUpgrade jakarta-commons-httpclientUpgrade pki-symkey-debuginfoUpgrade jss-debuginfoUpgrade glassfish-fastinfosetUpgrade jss | Oct 4, 2021 | Feb 10, 2020 |
| Debian | — | Upgrade jackson-databind | Feb 24, 2020 | Feb 10, 2020 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 24, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 2, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Feb 10, 2020 |
| Redhat_linux | — | Upgrade pki-servlet-engineUpgrade python-nss-debugsourceUpgrade pki-base-javaUpgrade javassistUpgrade ldapjdk-javadocUpgrade jss-debuginfoUpgrade python3-nssUpgrade xalan-j2Upgrade jackson-coreUpgrade xerces-j2Upgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-txw2Upgrade pki-tools-debuginfoUpgrade xmlstreambufferUpgrade resteasyUpgrade tomcatjssUpgrade xml-commons-apisUpgrade jss-javadocUpgrade glassfish-jaxb-coreUpgrade pki-baseUpgrade python3-nss-debuginfoUpgrade javassist-javadocUpgrade python3-pkiUpgrade pki-core-debuginfoUpgrade pki-servlet-4.0-apiUpgrade apache-commons-langUpgrade ldapjdkUpgrade jackson-module-jaxb-annotationsUpgrade jackson-jaxrs-json-providerUpgrade jssUpgrade apache-commons-collectionsUpgrade slf4j-jdk14Upgrade jackson-annotationsUpgrade slf4jUpgrade pki-symkey-debuginfoUpgrade jakarta-commons-httpclientUpgrade jackson-jaxrs-providersUpgrade bea-stax-apiUpgrade velocityUpgrade glassfish-jaxb-apiUpgrade glassfish-fastinfosetUpgrade pki-kraUpgrade pki-toolsUpgrade pki-serverUpgrade stax-exUpgrade relaxngDatatypeUpgrade python-nss-docUpgrade pki-symkey | Oct 4, 2021 | Feb 10, 2020 |
| Rocky_linux | — | Upgrade python-nss-docUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade python3-nss | Mar 12, 2024 | Feb 10, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Feb 10, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub