FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade javassistUpgrade xml-commons-apisUpgrade xsomUpgrade jakarta-commons-httpclientUpgrade jackson-annotationsUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-txw2Upgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-runtimeUpgrade relaxngDatatypeUpgrade slf4jUpgrade apache-commons-langUpgrade xalan-j2Upgrade jackson-module-jaxb-annotationsUpgrade xml-commons-resolverUpgrade javassist-javadocUpgrade xerces-j2Upgrade python3-nssUpgrade glassfish-jaxb-apiUpgrade jackson-databindUpgrade jackson-jaxrs-providersUpgrade jackson-coreUpgrade apache-commons-collectionsUpgrade python-nss-docUpgrade xmlstreambufferUpgrade bea-stax-apiUpgrade stax-exUpgrade slf4j-jdk14Upgrade glassfish-jaxb-coreUpgrade velocity | May 13, 2022 | Mar 2, 2020 |
| Centos_linux | — | Upgrade jackson-module-jaxb-annotationsUpgrade glassfish-fastinfosetUpgrade python-nss-debugsourceUpgrade relaxngDatatypeUpgrade jackson-annotationsUpgrade pki-kraUpgrade javassist-javadocUpgrade pki-serverUpgrade pki-caUpgrade python3-nss-debuginfoUpgrade xalan-j2Upgrade jss-debugsourceUpgrade xsomUpgrade javassistUpgrade pki-servlet-4.0-apiUpgrade jssUpgrade jakarta-commons-httpclientUpgrade xml-commons-apisUpgrade slf4jUpgrade pki-toolsUpgrade jss-debuginfoUpgrade pki-base-javaUpgrade pki-symkeyUpgrade ldapjdkUpgrade bea-stax-apiUpgrade velocityUpgrade python3-pkiUpgrade python3-nssUpgrade pki-symkey-debuginfoUpgrade ldapjdk-javadocUpgrade jackson-jaxrs-json-providerUpgrade jackson-coreUpgrade resteasyUpgrade xml-commons-resolverUpgrade stax-exUpgrade apache-commons-collectionsUpgrade apache-commons-langUpgrade glassfish-jaxb-coreUpgrade python-nss-docUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-runtimeUpgrade jackson-jaxrs-providersUpgrade pki-core-debugsourceUpgrade jss-javadocUpgrade jackson-databindUpgrade pki-baseUpgrade tomcatjssUpgrade slf4j-jdk14Upgrade pki-tools-debuginfoUpgrade pki-servlet-engineUpgrade pki-core-debuginfoUpgrade xmlstreambufferUpgrade xerces-j2 | Oct 4, 2021 | Mar 2, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 9, 2020 | Mar 2, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 2, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 2, 2020 |
| Redhat_linux | — | Upgrade glassfish-jaxb-apiUpgrade apache-commons-collectionsUpgrade javassist-javadocUpgrade velocityUpgrade jss-debuginfoUpgrade pki-serverUpgrade glassfish-jaxb-coreUpgrade xalan-j2Upgrade ldapjdk-javadocUpgrade python-nss-debugsourceUpgrade glassfish-jaxb-txw2Upgrade ldapjdkUpgrade jss-javadocUpgrade javassistUpgrade resteasyUpgrade pki-toolsUpgrade jakarta-commons-httpclientUpgrade bea-stax-apiUpgrade pki-symkeyUpgrade glassfish-fastinfosetUpgrade stax-exUpgrade pki-symkey-debuginfoUpgrade pki-base-javaUpgrade xml-commons-apisUpgrade jackson-jaxrs-providersUpgrade pki-core-debugsourceUpgrade jackson-databindUpgrade pki-baseUpgrade python3-nssUpgrade jackson-annotationsUpgrade pki-core-debuginfoUpgrade pki-caUpgrade pki-kraUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-runtimeUpgrade xsomUpgrade python3-nss-debuginfoUpgrade slf4j-jdk14Upgrade jssUpgrade jackson-jaxrs-json-providerUpgrade jss-debugsourceUpgrade apache-commons-langUpgrade jackson-module-jaxb-annotationsUpgrade jackson-coreUpgrade python-nss-docUpgrade xmlstreambufferUpgrade pki-tools-debuginfoUpgrade xml-commons-resolverUpgrade xerces-j2Upgrade tomcatjssUpgrade pki-servlet-engineUpgrade slf4jUpgrade python3-pkiUpgrade relaxngDatatype | Oct 4, 2021 | Mar 2, 2020 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python-nss-docUpgrade python3-nssUpgrade python-nss-debugsource | Mar 12, 2024 | Mar 2, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub