FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-jaxrs-json-providerUpgrade javassist-javadocUpgrade xalan-j2Upgrade xml-commons-resolverUpgrade glassfish-fastinfosetUpgrade slf4jUpgrade javassistUpgrade glassfish-jaxb-txw2Upgrade jakarta-commons-httpclientUpgrade jackson-module-jaxb-annotationsUpgrade relaxngDatatypeUpgrade xsomUpgrade xml-commons-apisUpgrade glassfish-jaxb-runtimeUpgrade jackson-annotationsUpgrade apache-commons-langUpgrade python-nss-docUpgrade bea-stax-apiUpgrade velocityUpgrade slf4j-jdk14Upgrade glassfish-jaxb-apiUpgrade python3-nssUpgrade stax-exUpgrade jackson-databindUpgrade apache-commons-collectionsUpgrade xmlstreambufferUpgrade jackson-coreUpgrade xerces-j2Upgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-core | May 13, 2022 | Mar 2, 2020 |
| Centos_linux | — | Upgrade jss-debuginfoUpgrade pki-servlet-4.0-apiUpgrade xalan-j2Upgrade pki-caUpgrade xml-commons-apisUpgrade jakarta-commons-httpclientUpgrade pki-toolsUpgrade xsomUpgrade pki-base-javaUpgrade pki-serverUpgrade jss-debugsourceUpgrade javassistUpgrade jssUpgrade slf4jUpgrade jackson-annotationsUpgrade javassist-javadocUpgrade pki-kraUpgrade relaxngDatatypeUpgrade jackson-module-jaxb-annotationsUpgrade python-nss-debugsourceUpgrade glassfish-fastinfosetUpgrade python3-nss-debuginfoUpgrade pki-core-debuginfoUpgrade slf4j-jdk14Upgrade pki-tools-debuginfoUpgrade pki-servlet-engineUpgrade bea-stax-apiUpgrade tomcatjssUpgrade pki-baseUpgrade jss-javadocUpgrade pki-core-debugsourceUpgrade jackson-jaxrs-providersUpgrade xml-commons-resolverUpgrade stax-exUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-apiUpgrade ldapjdkUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-coreUpgrade pki-symkeyUpgrade resteasyUpgrade velocityUpgrade python3-pkiUpgrade python3-nssUpgrade pki-symkey-debuginfoUpgrade ldapjdk-javadocUpgrade jackson-jaxrs-json-providerUpgrade jackson-coreUpgrade apache-commons-langUpgrade jackson-databindUpgrade python-nss-docUpgrade glassfish-jaxb-runtimeUpgrade xmlstreambufferUpgrade xerces-j2 | Oct 4, 2021 | Mar 2, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 9, 2020 | Mar 2, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 2, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 2, 2020 |
| Redhat_linux | — | Upgrade javassistUpgrade pki-symkey-debuginfoUpgrade relaxngDatatypeUpgrade stax-exUpgrade javassist-javadocUpgrade pki-base-javaUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-apiUpgrade jakarta-commons-httpclientUpgrade resteasyUpgrade pki-toolsUpgrade jss-javadocUpgrade apache-commons-collectionsUpgrade velocityUpgrade ldapjdkUpgrade jss-debuginfoUpgrade python-nss-debugsourceUpgrade glassfish-jaxb-coreUpgrade ldapjdk-javadocUpgrade pki-symkeyUpgrade pki-servlet-engineUpgrade glassfish-fastinfosetUpgrade xalan-j2Upgrade pki-serverUpgrade bea-stax-apiUpgrade tomcatjssUpgrade python3-pkiUpgrade slf4jUpgrade jssUpgrade pki-core-debuginfoUpgrade jackson-annotationsUpgrade jackson-module-jaxb-annotationsUpgrade jss-debugsourceUpgrade pki-kraUpgrade jackson-jaxrs-json-providerUpgrade xmlstreambufferUpgrade xml-commons-resolverUpgrade pki-tools-debuginfoUpgrade apache-commons-langUpgrade xerces-j2Upgrade xsomUpgrade pki-caUpgrade jackson-jaxrs-providersUpgrade slf4j-jdk14Upgrade python3-nssUpgrade jackson-coreUpgrade pki-servlet-4.0-apiUpgrade xml-commons-apisUpgrade python-nss-docUpgrade jackson-databindUpgrade pki-baseUpgrade glassfish-jaxb-runtimeUpgrade pki-core-debugsourceUpgrade python3-nss-debuginfo | Oct 4, 2021 | Mar 2, 2020 |
| Rocky_linux | — | Upgrade python-nss-debugsourceUpgrade python-nss-docUpgrade python3-nss-debuginfoUpgrade python3-nss | Mar 12, 2024 | Mar 2, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub