FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xml-commons-apisUpgrade javassistUpgrade glassfish-jaxb-txw2Upgrade xalan-j2Upgrade jakarta-commons-httpclientUpgrade javassist-javadocUpgrade xml-commons-resolverUpgrade slf4jUpgrade relaxngDatatypeUpgrade jackson-annotationsUpgrade xsomUpgrade glassfish-fastinfosetUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-runtimeUpgrade jackson-jaxrs-json-providerUpgrade apache-commons-langUpgrade jackson-jaxrs-providersUpgrade xerces-j2Upgrade python3-nssUpgrade xmlstreambufferUpgrade bea-stax-apiUpgrade glassfish-jaxb-apiUpgrade slf4j-jdk14Upgrade jackson-coreUpgrade jackson-databindUpgrade python-nss-docUpgrade velocityUpgrade stax-exUpgrade glassfish-jaxb-coreUpgrade apache-commons-collections | May 13, 2022 | Mar 2, 2020 |
| Centos_linux | — | Upgrade jackson-module-jaxb-annotationsUpgrade pki-toolsUpgrade xsomUpgrade jssUpgrade glassfish-fastinfosetUpgrade javassistUpgrade jackson-annotationsUpgrade python-nss-debugsourceUpgrade xalan-j2Upgrade python3-nss-debuginfoUpgrade jss-debugsourceUpgrade pki-serverUpgrade jss-debuginfoUpgrade javassist-javadocUpgrade pki-base-javaUpgrade pki-caUpgrade pki-servlet-4.0-apiUpgrade xml-commons-apisUpgrade jakarta-commons-httpclientUpgrade slf4jUpgrade relaxngDatatypeUpgrade pki-kraUpgrade jackson-jaxrs-providersUpgrade jackson-databindUpgrade bea-stax-apiUpgrade velocityUpgrade python3-pkiUpgrade python3-nssUpgrade pki-symkey-debuginfoUpgrade ldapjdk-javadocUpgrade jackson-jaxrs-json-providerUpgrade jackson-coreUpgrade resteasyUpgrade pki-core-debuginfoUpgrade slf4j-jdk14Upgrade pki-servlet-engineUpgrade pki-core-debugsourceUpgrade jss-javadocUpgrade pki-baseUpgrade ldapjdkUpgrade glassfish-jaxb-apiUpgrade apache-commons-langUpgrade pki-symkeyUpgrade tomcatjssUpgrade pki-tools-debuginfoUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-resolverUpgrade stax-exUpgrade python-nss-docUpgrade glassfish-jaxb-txw2Upgrade apache-commons-collectionsUpgrade glassfish-jaxb-coreUpgrade xmlstreambufferUpgrade xerces-j2 | Oct 4, 2021 | Mar 2, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 9, 2020 | Mar 2, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 2, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 2, 2020 |
| Redhat_linux | — | Upgrade jackson-jaxrs-json-providerUpgrade pki-baseUpgrade xml-commons-resolverUpgrade jssUpgrade pki-core-debugsourceUpgrade glassfish-jaxb-runtimeUpgrade jackson-module-jaxb-annotationsUpgrade jackson-coreUpgrade xmlstreambufferUpgrade apache-commons-langUpgrade jss-debugsourceUpgrade pki-core-debuginfoUpgrade xml-commons-apisUpgrade pki-servlet-4.0-apiUpgrade python-nss-docUpgrade python3-nssUpgrade pki-tools-debuginfoUpgrade python3-nss-debuginfoUpgrade jackson-databindUpgrade jackson-jaxrs-providersUpgrade xerces-j2Upgrade jackson-annotationsUpgrade slf4j-jdk14Upgrade pki-kraUpgrade pki-caUpgrade xsomUpgrade pki-serverUpgrade glassfish-jaxb-txw2Upgrade python-nss-debugsourceUpgrade relaxngDatatypeUpgrade python3-pkiUpgrade velocityUpgrade jss-debuginfoUpgrade glassfish-jaxb-coreUpgrade ldapjdk-javadocUpgrade glassfish-fastinfosetUpgrade pki-toolsUpgrade pki-symkey-debuginfoUpgrade xalan-j2Upgrade stax-exUpgrade slf4jUpgrade jss-javadocUpgrade javassistUpgrade jakarta-commons-httpclientUpgrade ldapjdkUpgrade resteasyUpgrade pki-base-javaUpgrade pki-symkeyUpgrade javassist-javadocUpgrade tomcatjssUpgrade pki-servlet-engineUpgrade bea-stax-apiUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-api | Oct 4, 2021 | Mar 2, 2020 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade python-nss-doc | Mar 12, 2024 | Mar 2, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub