FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade javassistUpgrade xml-commons-resolverUpgrade javassist-javadocUpgrade jackson-module-jaxb-annotationsUpgrade xalan-j2Upgrade slf4jUpgrade glassfish-jaxb-txw2Upgrade xsomUpgrade jakarta-commons-httpclientUpgrade glassfish-fastinfosetUpgrade jackson-annotationsUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-apisUpgrade relaxngDatatypeUpgrade jackson-jaxrs-json-providerUpgrade apache-commons-langUpgrade stax-exUpgrade jackson-databindUpgrade jackson-jaxrs-providersUpgrade python-nss-docUpgrade apache-commons-collectionsUpgrade slf4j-jdk14Upgrade xerces-j2Upgrade jackson-coreUpgrade glassfish-jaxb-coreUpgrade velocityUpgrade bea-stax-apiUpgrade glassfish-jaxb-apiUpgrade xmlstreambufferUpgrade python3-nss | May 13, 2022 | Mar 2, 2020 |
| Centos_linux | — | Upgrade relaxngDatatypeUpgrade xsomUpgrade pki-servlet-4.0-apiUpgrade jackson-module-jaxb-annotationsUpgrade pki-serverUpgrade pki-kraUpgrade jss-debuginfoUpgrade xalan-j2Upgrade jssUpgrade jss-debugsourceUpgrade pki-caUpgrade python3-nss-debuginfoUpgrade jakarta-commons-httpclientUpgrade xml-commons-apisUpgrade pki-base-javaUpgrade glassfish-fastinfosetUpgrade javassistUpgrade pki-toolsUpgrade javassist-javadocUpgrade python-nss-debugsourceUpgrade slf4jUpgrade jackson-annotationsUpgrade python-nss-docUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-apiUpgrade xmlstreambufferUpgrade xerces-j2Upgrade bea-stax-apiUpgrade slf4j-jdk14Upgrade pki-tools-debuginfoUpgrade pki-servlet-engineUpgrade tomcatjssUpgrade pki-core-debuginfoUpgrade apache-commons-langUpgrade jackson-jaxrs-providersUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-runtimeUpgrade pki-core-debugsourceUpgrade jss-javadocUpgrade pki-baseUpgrade resteasyUpgrade python3-nssUpgrade ldapjdk-javadocUpgrade jackson-coreUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-resolverUpgrade stax-exUpgrade python3-pkiUpgrade velocityUpgrade jackson-databindUpgrade pki-symkey-debuginfoUpgrade glassfish-jaxb-coreUpgrade pki-symkeyUpgrade ldapjdk | Oct 4, 2021 | Mar 2, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 9, 2020 | Mar 2, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 2, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 2, 2020 |
| Redhat_linux | — | Upgrade jackson-coreUpgrade jss-debugsourceUpgrade xml-commons-apisUpgrade python-nss-docUpgrade jackson-module-jaxb-annotationsUpgrade jackson-jaxrs-json-providerUpgrade slf4j-jdk14Upgrade python3-nss-debuginfoUpgrade python3-nssUpgrade pki-kraUpgrade glassfish-jaxb-runtimeUpgrade jackson-annotationsUpgrade apache-commons-langUpgrade pki-tools-debuginfoUpgrade xml-commons-resolverUpgrade pki-caUpgrade pki-servlet-4.0-apiUpgrade pki-core-debuginfoUpgrade pki-baseUpgrade xsomUpgrade jackson-jaxrs-providersUpgrade jssUpgrade xmlstreambufferUpgrade xerces-j2Upgrade jackson-databindUpgrade pki-core-debugsourceUpgrade stax-exUpgrade pki-toolsUpgrade glassfish-jaxb-coreUpgrade python3-pkiUpgrade glassfish-jaxb-txw2Upgrade velocityUpgrade apache-commons-collectionsUpgrade javassistUpgrade ldapjdk-javadocUpgrade pki-base-javaUpgrade jss-debuginfoUpgrade pki-symkeyUpgrade slf4jUpgrade bea-stax-apiUpgrade python-nss-debugsourceUpgrade jakarta-commons-httpclientUpgrade relaxngDatatypeUpgrade javassist-javadocUpgrade resteasyUpgrade glassfish-jaxb-apiUpgrade pki-servlet-engineUpgrade ldapjdkUpgrade pki-serverUpgrade xalan-j2Upgrade jss-javadocUpgrade tomcatjssUpgrade pki-symkey-debuginfoUpgrade glassfish-fastinfoset | Oct 4, 2021 | Mar 2, 2020 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade python-nss-doc | Mar 12, 2024 | Mar 2, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub