FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xerces-j2Upgrade jackson-module-jaxb-annotationsUpgrade javassist-javadocUpgrade slf4jUpgrade jackson-annotationsUpgrade apache-commons-langUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-apiUpgrade relaxngDatatypeUpgrade glassfish-fastinfosetUpgrade xalan-j2Upgrade xml-commons-apisUpgrade jackson-jaxrs-json-providerUpgrade xmlstreambufferUpgrade jackson-databindUpgrade jackson-coreUpgrade jackson-jaxrs-providersUpgrade python3-nssUpgrade slf4j-jdk14Upgrade bea-stax-apiUpgrade jakarta-commons-httpclientUpgrade xml-commons-resolverUpgrade stax-exUpgrade velocityUpgrade python-nss-docUpgrade xsomUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-txw2Upgrade javassistUpgrade apache-commons-collections | May 13, 2022 | Mar 2, 2020 |
| Centos_linux | — | Upgrade javassist-javadocUpgrade pki-core-debuginfoUpgrade xalan-j2Upgrade jackson-module-jaxb-annotationsUpgrade slf4jUpgrade pki-caUpgrade pki-servlet-4.0-apiUpgrade xml-commons-resolverUpgrade jackson-coreUpgrade jssUpgrade glassfish-jaxb-txw2Upgrade jackson-jaxrs-json-providerUpgrade jss-debuginfoUpgrade jackson-annotationsUpgrade pki-core-debugsourceUpgrade python3-nss-debuginfoUpgrade jackson-databindUpgrade python-nss-debugsourceUpgrade pki-baseUpgrade glassfish-fastinfosetUpgrade xml-commons-apisUpgrade pki-toolsUpgrade relaxngDatatypeUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-runtimeUpgrade jss-debugsourceUpgrade pki-base-javaUpgrade xsomUpgrade pki-serverUpgrade python-nss-docUpgrade jackson-jaxrs-providersUpgrade python3-nssUpgrade xerces-j2Upgrade bea-stax-apiUpgrade pki-servlet-engineUpgrade velocityUpgrade slf4j-jdk14Upgrade apache-commons-langUpgrade apache-commons-collectionsUpgrade python3-pkiUpgrade pki-tools-debuginfoUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-apiUpgrade resteasyUpgrade xmlstreambufferUpgrade stax-exUpgrade pki-symkeyUpgrade ldapjdk-javadocUpgrade pki-symkey-debuginfoUpgrade tomcatjssUpgrade pki-kraUpgrade ldapjdkUpgrade jss-javadocUpgrade javassist | Oct 4, 2021 | Mar 2, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 9, 2020 | Mar 2, 2020 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 31537019 for version 12.2.1.4.0.Apply the Patch Set Update (PSU) 31535411 for version 12.2.1.3.0. | Jul 14, 2020 | Mar 2, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 2, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 2, 2020 |
| Redhat_linux | — | Upgrade pki-servlet-engineUpgrade pki-baseUpgrade glassfish-fastinfosetUpgrade pki-kraUpgrade jss-javadocUpgrade pki-symkey-debuginfoUpgrade xerces-j2Upgrade bea-stax-apiUpgrade pki-serverUpgrade ldapjdkUpgrade jackson-module-jaxb-annotationsUpgrade relaxngDatatypeUpgrade python3-pkiUpgrade jackson-coreUpgrade pki-symkeyUpgrade pki-core-debuginfoUpgrade jackson-jaxrs-providersUpgrade python-nss-docUpgrade python-nss-debugsourceUpgrade slf4j-jdk14Upgrade pki-toolsUpgrade python3-nssUpgrade pki-base-javaUpgrade apache-commons-langUpgrade jackson-databindUpgrade jackson-jaxrs-json-providerUpgrade javassistUpgrade stax-exUpgrade resteasyUpgrade xml-commons-apisUpgrade pki-tools-debuginfoUpgrade ldapjdk-javadocUpgrade javassist-javadocUpgrade xalan-j2Upgrade jackson-annotationsUpgrade glassfish-jaxb-apiUpgrade xmlstreambufferUpgrade tomcatjssUpgrade velocityUpgrade pki-core-debugsourceUpgrade jakarta-commons-httpclient | Oct 4, 2021 | Mar 2, 2020 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-docUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfo | Mar 12, 2024 | Mar 2, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub