FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade velocityUpgrade stax-exUpgrade glassfish-jaxb-coreUpgrade xsomUpgrade glassfish-jaxb-txw2Upgrade bea-stax-apiUpgrade javassistUpgrade slf4j-jdk14Upgrade apache-commons-collectionsUpgrade python-nss-docUpgrade python3-nssUpgrade jackson-jaxrs-providersUpgrade jakarta-commons-httpclientUpgrade xml-commons-resolverUpgrade jackson-coreUpgrade javassist-javadocUpgrade xmlstreambufferUpgrade jackson-databindUpgrade glassfish-fastinfosetUpgrade xerces-j2Upgrade relaxngDatatypeUpgrade glassfish-jaxb-apiUpgrade xml-commons-apisUpgrade jackson-annotationsUpgrade xalan-j2Upgrade jackson-module-jaxb-annotationsUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-runtimeUpgrade slf4jUpgrade apache-commons-lang | May 13, 2022 | Mar 2, 2020 |
| Centos_linux | — | Upgrade python3-nss-debuginfoUpgrade pki-caUpgrade pki-core-debugsourceUpgrade jackson-databindUpgrade pki-toolsUpgrade pki-base-javaUpgrade glassfish-jaxb-runtimeUpgrade pki-core-debuginfoUpgrade pki-servlet-4.0-apiUpgrade pki-serverUpgrade jackson-jaxrs-json-providerUpgrade python-nss-debugsourceUpgrade xml-commons-resolverUpgrade glassfish-jaxb-coreUpgrade xalan-j2Upgrade glassfish-fastinfosetUpgrade jackson-module-jaxb-annotationsUpgrade jss-debuginfoUpgrade slf4jUpgrade glassfish-jaxb-txw2Upgrade jss-debugsourceUpgrade xml-commons-apisUpgrade relaxngDatatypeUpgrade jssUpgrade javassist-javadocUpgrade pki-baseUpgrade xsomUpgrade jackson-coreUpgrade jackson-annotationsUpgrade xerces-j2Upgrade xmlstreambufferUpgrade glassfish-jaxb-apiUpgrade python-nss-docUpgrade stax-exUpgrade tomcatjssUpgrade python3-nssUpgrade pki-symkey-debuginfoUpgrade ldapjdkUpgrade jss-javadocUpgrade javassistUpgrade pki-kraUpgrade pki-symkeyUpgrade velocityUpgrade slf4j-jdk14Upgrade apache-commons-langUpgrade apache-commons-collectionsUpgrade pki-servlet-engineUpgrade python3-pkiUpgrade pki-tools-debuginfoUpgrade resteasyUpgrade jackson-jaxrs-providersUpgrade bea-stax-apiUpgrade ldapjdk-javadocUpgrade jakarta-commons-httpclient | Oct 4, 2021 | Mar 2, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 9, 2020 | Mar 2, 2020 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 31535411 for version 12.2.1.3.0.Apply the Patch Set Update (PSU) 31537019 for version 12.2.1.4.0. | Jul 14, 2020 | Mar 2, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 2, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 2, 2020 |
| Redhat_linux | — | Upgrade python3-nss-debuginfoUpgrade pki-servlet-4.0-apiUpgrade slf4j-jdk14Upgrade xsomUpgrade xml-commons-resolverUpgrade jss-debugsourceUpgrade glassfish-jaxb-runtimeUpgrade jss-debuginfoUpgrade python-nss-docUpgrade apache-commons-collectionsUpgrade pki-toolsUpgrade python-nss-debugsourceUpgrade pki-caUpgrade jssUpgrade python3-nssUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-coreUpgrade jackson-coreUpgrade pki-core-debuginfoUpgrade jackson-jaxrs-providersUpgrade slf4jUpgrade pki-symkeyUpgrade jackson-module-jaxb-annotationsUpgrade pki-symkey-debuginfoUpgrade python3-pkiUpgrade tomcatjssUpgrade velocityUpgrade bea-stax-apiUpgrade jackson-annotationsUpgrade jakarta-commons-httpclientUpgrade pki-servlet-engineUpgrade pki-tools-debuginfoUpgrade jss-javadocUpgrade apache-commons-langUpgrade stax-exUpgrade pki-base-javaUpgrade pki-baseUpgrade resteasyUpgrade javassistUpgrade xalan-j2Upgrade xml-commons-apisUpgrade ldapjdk-javadocUpgrade pki-serverUpgrade javassist-javadocUpgrade pki-kraUpgrade xerces-j2Upgrade glassfish-fastinfosetUpgrade ldapjdkUpgrade jackson-databindUpgrade xmlstreambufferUpgrade jackson-jaxrs-json-providerUpgrade pki-core-debugsourceUpgrade relaxngDatatypeUpgrade glassfish-jaxb-api | Oct 4, 2021 | Mar 2, 2020 |
| Rocky_linux | — | Upgrade python-nss-debugsourceUpgrade python3-nss-debuginfoUpgrade python3-nssUpgrade python-nss-doc | Mar 12, 2024 | Mar 2, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub