FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-jaxrs-json-providerUpgrade jackson-annotationsUpgrade apache-commons-langUpgrade glassfish-fastinfosetUpgrade slf4jUpgrade xml-commons-resolverUpgrade xml-commons-apisUpgrade javassistUpgrade jakarta-commons-httpclientUpgrade javassist-javadocUpgrade glassfish-jaxb-txw2Upgrade relaxngDatatypeUpgrade xsomUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-runtimeUpgrade xalan-j2Upgrade bea-stax-apiUpgrade glassfish-jaxb-coreUpgrade xmlstreambufferUpgrade glassfish-jaxb-apiUpgrade velocityUpgrade python3-nssUpgrade jackson-databindUpgrade slf4j-jdk14Upgrade apache-commons-collectionsUpgrade stax-exUpgrade jackson-coreUpgrade python-nss-docUpgrade xerces-j2Upgrade jackson-jaxrs-providers | May 13, 2022 | Mar 2, 2020 |
| Centos_linux | — | Upgrade pki-kraUpgrade slf4jUpgrade javassistUpgrade xsomUpgrade pki-serverUpgrade pki-toolsUpgrade jakarta-commons-httpclientUpgrade jssUpgrade xml-commons-apisUpgrade xalan-j2Upgrade python-nss-debugsourceUpgrade jackson-annotationsUpgrade relaxngDatatypeUpgrade javassist-javadocUpgrade jss-debuginfoUpgrade pki-caUpgrade jackson-module-jaxb-annotationsUpgrade pki-base-javaUpgrade python3-nss-debuginfoUpgrade jss-debugsourceUpgrade pki-servlet-4.0-apiUpgrade glassfish-fastinfosetUpgrade ldapjdk-javadocUpgrade python3-pkiUpgrade jackson-jaxrs-json-providerUpgrade jss-javadocUpgrade jackson-databindUpgrade pki-core-debugsourceUpgrade stax-exUpgrade apache-commons-collectionsUpgrade xml-commons-resolverUpgrade apache-commons-langUpgrade pki-tools-debuginfoUpgrade jackson-jaxrs-providersUpgrade pki-symkey-debuginfoUpgrade velocityUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-runtimeUpgrade python-nss-docUpgrade jackson-coreUpgrade xmlstreambufferUpgrade xerces-j2Upgrade bea-stax-apiUpgrade python3-nssUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-apiUpgrade pki-symkeyUpgrade ldapjdkUpgrade resteasyUpgrade slf4j-jdk14Upgrade pki-servlet-engineUpgrade pki-core-debuginfoUpgrade tomcatjssUpgrade pki-base | Oct 4, 2021 | Mar 2, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 9, 2020 | Mar 2, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 2, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 2, 2020 |
| Redhat_linux | — | Upgrade jackson-annotationsUpgrade pki-core-debuginfoUpgrade xsomUpgrade pki-servlet-4.0-apiUpgrade jssUpgrade xerces-j2Upgrade jackson-jaxrs-providersUpgrade pki-caUpgrade xml-commons-apisUpgrade python-nss-docUpgrade jackson-module-jaxb-annotationsUpgrade jss-debugsourceUpgrade pki-kraUpgrade pki-tools-debuginfoUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-resolverUpgrade jackson-jaxrs-json-providerUpgrade jackson-databindUpgrade apache-commons-langUpgrade pki-core-debugsourceUpgrade xmlstreambufferUpgrade python3-nssUpgrade jackson-coreUpgrade slf4j-jdk14Upgrade pki-baseUpgrade python3-nss-debuginfoUpgrade javassist-javadocUpgrade xalan-j2Upgrade pki-servlet-engineUpgrade glassfish-fastinfosetUpgrade pki-toolsUpgrade python-nss-debugsourceUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-coreUpgrade jss-debuginfoUpgrade pki-symkey-debuginfoUpgrade pki-base-javaUpgrade ldapjdkUpgrade jss-javadocUpgrade tomcatjssUpgrade slf4jUpgrade bea-stax-apiUpgrade javassistUpgrade resteasyUpgrade python3-pkiUpgrade glassfish-jaxb-txw2Upgrade apache-commons-collectionsUpgrade ldapjdk-javadocUpgrade velocityUpgrade stax-exUpgrade pki-symkeyUpgrade relaxngDatatypeUpgrade glassfish-jaxb-apiUpgrade pki-server | Oct 4, 2021 | Mar 2, 2020 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python-nss-docUpgrade python3-nssUpgrade python-nss-debugsource | Mar 12, 2024 | Mar 2, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub