FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python-nss-docUpgrade jakarta-commons-httpclientUpgrade javassistUpgrade xml-commons-resolverUpgrade glassfish-jaxb-txw2Upgrade jackson-jaxrs-providersUpgrade bea-stax-apiUpgrade python3-nssUpgrade glassfish-jaxb-coreUpgrade apache-commons-collectionsUpgrade slf4j-jdk14Upgrade velocityUpgrade stax-exUpgrade xsomUpgrade slf4jUpgrade jackson-module-jaxb-annotationsUpgrade jackson-jaxrs-json-providerUpgrade jackson-coreUpgrade xalan-j2Upgrade glassfish-jaxb-apiUpgrade apache-commons-langUpgrade glassfish-fastinfosetUpgrade xerces-j2Upgrade glassfish-jaxb-runtimeUpgrade jackson-annotationsUpgrade jackson-databindUpgrade xmlstreambufferUpgrade relaxngDatatypeUpgrade javassist-javadocUpgrade xml-commons-apis | May 13, 2022 | Mar 2, 2020 |
| Centos_linux | — | Upgrade xmlstreambufferUpgrade bea-stax-apiUpgrade glassfish-jaxb-apiUpgrade pki-symkeyUpgrade stax-exUpgrade python-nss-docUpgrade jakarta-commons-httpclientUpgrade jackson-jaxrs-providersUpgrade ldapjdkUpgrade ldapjdk-javadocUpgrade tomcatjssUpgrade pki-servlet-engineUpgrade javassistUpgrade python3-pkiUpgrade pki-tools-debuginfoUpgrade pki-symkey-debuginfoUpgrade python3-nssUpgrade jss-javadocUpgrade apache-commons-collectionsUpgrade apache-commons-langUpgrade pki-kraUpgrade slf4j-jdk14Upgrade resteasyUpgrade xerces-j2Upgrade velocityUpgrade javassist-javadocUpgrade glassfish-jaxb-runtimeUpgrade jackson-databindUpgrade python3-nss-debuginfoUpgrade jss-debuginfoUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-txw2Upgrade python-nss-debugsourceUpgrade glassfish-fastinfosetUpgrade xml-commons-resolverUpgrade pki-servlet-4.0-apiUpgrade jackson-module-jaxb-annotationsUpgrade slf4jUpgrade xalan-j2Upgrade jackson-coreUpgrade jackson-annotationsUpgrade xsomUpgrade pki-base-javaUpgrade jss-debugsourceUpgrade glassfish-jaxb-coreUpgrade pki-caUpgrade xml-commons-apisUpgrade relaxngDatatypeUpgrade jssUpgrade pki-toolsUpgrade pki-core-debugsourceUpgrade pki-baseUpgrade pki-serverUpgrade pki-core-debuginfo | Oct 4, 2021 | Mar 2, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 9, 2020 | Mar 2, 2020 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 31537019 for version 12.2.1.4.0.Apply the Patch Set Update (PSU) 31535411 for version 12.2.1.3.0. | Jul 14, 2020 | Mar 2, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 2, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 2, 2020 |
| Redhat_linux | — | Upgrade jss-debuginfoUpgrade pki-toolsUpgrade slf4jUpgrade python-nss-docUpgrade jackson-coreUpgrade jackson-jaxrs-providersUpgrade python3-nss-debuginfoUpgrade pki-caUpgrade slf4j-jdk14Upgrade jssUpgrade glassfish-jaxb-txw2Upgrade python-nss-debugsourceUpgrade pki-core-debuginfoUpgrade jss-debugsourceUpgrade glassfish-jaxb-coreUpgrade xsomUpgrade pki-servlet-4.0-apiUpgrade pki-symkeyUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-resolverUpgrade apache-commons-collectionsUpgrade python3-nssUpgrade pki-kraUpgrade jakarta-commons-httpclientUpgrade jss-javadocUpgrade resteasyUpgrade javassist-javadocUpgrade xml-commons-apisUpgrade relaxngDatatypeUpgrade ldapjdkUpgrade jackson-module-jaxb-annotationsUpgrade ldapjdk-javadocUpgrade jackson-databindUpgrade jackson-annotationsUpgrade pki-core-debugsourceUpgrade glassfish-fastinfosetUpgrade pki-base-javaUpgrade apache-commons-langUpgrade pki-baseUpgrade python3-pkiUpgrade pki-tools-debuginfoUpgrade velocityUpgrade jackson-jaxrs-json-providerUpgrade xerces-j2Upgrade glassfish-jaxb-apiUpgrade pki-servlet-engineUpgrade bea-stax-apiUpgrade javassistUpgrade pki-symkey-debuginfoUpgrade tomcatjssUpgrade pki-serverUpgrade xalan-j2Upgrade stax-exUpgrade xmlstreambuffer | Oct 4, 2021 | Mar 2, 2020 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade python-nss-docUpgrade python3-nss | Mar 12, 2024 | Mar 2, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub