FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xml-commons-resolverUpgrade xsomUpgrade stax-exUpgrade python-nss-docUpgrade python3-nssUpgrade glassfish-jaxb-coreUpgrade apache-commons-collectionsUpgrade javassistUpgrade bea-stax-apiUpgrade velocityUpgrade glassfish-jaxb-txw2Upgrade jakarta-commons-httpclientUpgrade jackson-jaxrs-providersUpgrade slf4j-jdk14Upgrade jackson-databindUpgrade apache-commons-langUpgrade glassfish-jaxb-apiUpgrade javassist-javadocUpgrade xerces-j2Upgrade relaxngDatatypeUpgrade jackson-coreUpgrade jackson-annotationsUpgrade jackson-module-jaxb-annotationsUpgrade xmlstreambufferUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-runtimeUpgrade slf4jUpgrade glassfish-fastinfosetUpgrade xalan-j2Upgrade xml-commons-apis | May 13, 2022 | Mar 2, 2020 |
| Centos_linux | — | Upgrade python-nss-docUpgrade pki-tools-debuginfoUpgrade xmlstreambufferUpgrade apache-commons-collectionsUpgrade apache-commons-langUpgrade glassfish-jaxb-apiUpgrade slf4j-jdk14Upgrade python3-pkiUpgrade jakarta-commons-httpclientUpgrade jackson-jaxrs-providersUpgrade pki-kraUpgrade javassistUpgrade ldapjdkUpgrade jss-javadocUpgrade python3-nssUpgrade tomcatjssUpgrade resteasyUpgrade xerces-j2Upgrade pki-symkey-debuginfoUpgrade velocityUpgrade ldapjdk-javadocUpgrade bea-stax-apiUpgrade pki-servlet-engineUpgrade pki-symkeyUpgrade stax-exUpgrade python-nss-debugsourceUpgrade pki-core-debugsourceUpgrade pki-core-debuginfoUpgrade jss-debuginfoUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-txw2Upgrade glassfish-fastinfosetUpgrade pki-servlet-4.0-apiUpgrade xml-commons-resolverUpgrade jackson-databindUpgrade python3-nss-debuginfoUpgrade pki-baseUpgrade jackson-coreUpgrade glassfish-jaxb-runtimeUpgrade pki-serverUpgrade jackson-module-jaxb-annotationsUpgrade slf4jUpgrade jackson-annotationsUpgrade javassist-javadocUpgrade jssUpgrade pki-caUpgrade xalan-j2Upgrade xml-commons-apisUpgrade jss-debugsourceUpgrade glassfish-jaxb-coreUpgrade xsomUpgrade relaxngDatatypeUpgrade pki-toolsUpgrade pki-base-java | Oct 4, 2021 | Mar 2, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 9, 2020 | Mar 2, 2020 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 31537019 for version 12.2.1.4.0.Apply the Patch Set Update (PSU) 31535411 for version 12.2.1.3.0. | Jul 14, 2020 | Mar 2, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 2, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 2, 2020 |
| Redhat_linux | — | Upgrade pki-servlet-4.0-apiUpgrade slf4jUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-resolverUpgrade python-nss-docUpgrade xsomUpgrade jss-debuginfoUpgrade python3-nss-debuginfoUpgrade pki-core-debuginfoUpgrade python3-nssUpgrade jackson-jaxrs-providersUpgrade pki-symkeyUpgrade python-nss-debugsourceUpgrade jssUpgrade pki-caUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-coreUpgrade slf4j-jdk14Upgrade jss-debugsourceUpgrade pki-toolsUpgrade apache-commons-collectionsUpgrade jackson-coreUpgrade javassist-javadocUpgrade ldapjdk-javadocUpgrade stax-exUpgrade jakarta-commons-httpclientUpgrade pki-kraUpgrade jss-javadocUpgrade jackson-jaxrs-json-providerUpgrade xmlstreambufferUpgrade pki-base-javaUpgrade jackson-databindUpgrade pki-tools-debuginfoUpgrade pki-symkey-debuginfoUpgrade javassistUpgrade pki-servlet-engineUpgrade glassfish-jaxb-apiUpgrade bea-stax-apiUpgrade ldapjdkUpgrade relaxngDatatypeUpgrade resteasyUpgrade python3-pkiUpgrade xml-commons-apisUpgrade apache-commons-langUpgrade jackson-module-jaxb-annotationsUpgrade jackson-annotationsUpgrade pki-baseUpgrade xerces-j2Upgrade glassfish-fastinfosetUpgrade pki-core-debugsourceUpgrade pki-serverUpgrade velocityUpgrade xalan-j2Upgrade tomcatjss | Oct 4, 2021 | Mar 2, 2020 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade python3-nssUpgrade python-nss-doc | Mar 12, 2024 | Mar 2, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub