FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xsomUpgrade javassistUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-coreUpgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-txw2Upgrade python3-nssUpgrade jakarta-commons-httpclientUpgrade velocityUpgrade slf4j-jdk14Upgrade xml-commons-resolverUpgrade stax-exUpgrade python-nss-docUpgrade bea-stax-apiUpgrade slf4jUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-apisUpgrade javassist-javadocUpgrade glassfish-jaxb-apiUpgrade xalan-j2Upgrade relaxngDatatypeUpgrade apache-commons-langUpgrade jackson-coreUpgrade xmlstreambufferUpgrade xerces-j2Upgrade jackson-jaxrs-json-providerUpgrade jackson-module-jaxb-annotationsUpgrade jackson-annotationsUpgrade jackson-databind | May 13, 2022 | Mar 2, 2020 |
| Centos_linux | — | Upgrade python-nss-debugsourceUpgrade glassfish-fastinfosetUpgrade xml-commons-apisUpgrade pki-serverUpgrade glassfish-jaxb-runtimeUpgrade pki-toolsUpgrade pki-base-javaUpgrade jss-debugsourceUpgrade jackson-jaxrs-json-providerUpgrade javassist-javadocUpgrade jackson-annotationsUpgrade glassfish-jaxb-coreUpgrade xsomUpgrade jackson-coreUpgrade xalan-j2Upgrade jackson-databindUpgrade slf4jUpgrade xml-commons-resolverUpgrade pki-baseUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-txw2Upgrade pki-caUpgrade pki-servlet-4.0-apiUpgrade pki-core-debugsourceUpgrade pki-core-debuginfoUpgrade jssUpgrade python3-nss-debuginfoUpgrade jss-debuginfoUpgrade relaxngDatatypeUpgrade velocityUpgrade jakarta-commons-httpclientUpgrade python-nss-docUpgrade ldapjdk-javadocUpgrade slf4j-jdk14Upgrade apache-commons-langUpgrade apache-commons-collectionsUpgrade bea-stax-apiUpgrade xmlstreambufferUpgrade stax-exUpgrade pki-servlet-engineUpgrade pki-symkeyUpgrade ldapjdkUpgrade jss-javadocUpgrade javassistUpgrade pki-kraUpgrade python3-pkiUpgrade pki-tools-debuginfoUpgrade glassfish-jaxb-apiUpgrade python3-nssUpgrade pki-symkey-debuginfoUpgrade tomcatjssUpgrade xerces-j2Upgrade resteasyUpgrade jackson-jaxrs-providers | Oct 4, 2021 | Mar 2, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 9, 2020 | Mar 2, 2020 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 31535411 for version 12.2.1.3.0.Apply the Patch Set Update (PSU) 31537019 for version 12.2.1.4.0. | Jul 14, 2020 | Mar 2, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 2, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 2, 2020 |
| Redhat_linux | — | Upgrade xsomUpgrade slf4jUpgrade xml-commons-resolverUpgrade pki-servlet-4.0-apiUpgrade jss-debuginfoUpgrade glassfish-jaxb-runtimeUpgrade pki-core-debuginfoUpgrade pki-toolsUpgrade python-nss-debugsourceUpgrade jssUpgrade python-nss-docUpgrade glassfish-jaxb-coreUpgrade pki-symkeyUpgrade jackson-jaxrs-providersUpgrade python3-nssUpgrade jackson-coreUpgrade glassfish-jaxb-txw2Upgrade pki-caUpgrade slf4j-jdk14Upgrade apache-commons-collectionsUpgrade jss-debugsourceUpgrade python3-nss-debuginfoUpgrade ldapjdkUpgrade jackson-module-jaxb-annotationsUpgrade relaxngDatatypeUpgrade pki-baseUpgrade xerces-j2Upgrade python3-pkiUpgrade pki-base-javaUpgrade glassfish-fastinfosetUpgrade pki-kraUpgrade jakarta-commons-httpclientUpgrade tomcatjssUpgrade jackson-jaxrs-json-providerUpgrade javassist-javadocUpgrade velocityUpgrade jackson-databindUpgrade xmlstreambufferUpgrade xalan-j2Upgrade apache-commons-langUpgrade jackson-annotationsUpgrade xml-commons-apisUpgrade stax-exUpgrade pki-serverUpgrade javassistUpgrade pki-symkey-debuginfoUpgrade pki-servlet-engineUpgrade glassfish-jaxb-apiUpgrade bea-stax-apiUpgrade jss-javadocUpgrade pki-tools-debuginfoUpgrade resteasyUpgrade ldapjdk-javadocUpgrade pki-core-debugsource | Oct 4, 2021 | Mar 2, 2020 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-docUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfo | Mar 12, 2024 | Mar 2, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub