FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-annotationsUpgrade javassistUpgrade glassfish-fastinfosetUpgrade xml-commons-resolverUpgrade apache-commons-langUpgrade relaxngDatatypeUpgrade jackson-module-jaxb-annotationsUpgrade xsomUpgrade glassfish-jaxb-txw2Upgrade xalan-j2Upgrade slf4jUpgrade jackson-jaxrs-json-providerUpgrade jakarta-commons-httpclientUpgrade javassist-javadocUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-apisUpgrade stax-exUpgrade glassfish-jaxb-apiUpgrade xmlstreambufferUpgrade python3-nssUpgrade jackson-databindUpgrade jackson-coreUpgrade glassfish-jaxb-coreUpgrade velocityUpgrade xerces-j2Upgrade jackson-jaxrs-providersUpgrade python-nss-docUpgrade bea-stax-apiUpgrade apache-commons-collectionsUpgrade slf4j-jdk14 | May 13, 2022 | Mar 2, 2020 |
| Centos_linux | — | Upgrade python3-pkiUpgrade velocityUpgrade pki-tools-debuginfoUpgrade slf4j-jdk14Upgrade tomcatjssUpgrade xerces-j2Upgrade jackson-jaxrs-json-providerUpgrade bea-stax-apiUpgrade ldapjdk-javadocUpgrade pki-core-debuginfoUpgrade python3-nssUpgrade pki-core-debugsourceUpgrade pki-baseUpgrade apache-commons-collectionsUpgrade stax-exUpgrade pki-servlet-engineUpgrade xml-commons-resolverUpgrade resteasyUpgrade pki-symkey-debuginfoUpgrade jackson-coreUpgrade jackson-databindUpgrade python-nss-docUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-coreUpgrade jss-javadocUpgrade xmlstreambufferUpgrade glassfish-jaxb-apiUpgrade ldapjdkUpgrade jackson-jaxrs-providersUpgrade pki-symkeyUpgrade apache-commons-langUpgrade glassfish-fastinfosetUpgrade python-nss-debugsourceUpgrade jssUpgrade javassistUpgrade jss-debuginfoUpgrade xalan-j2Upgrade jackson-annotationsUpgrade python3-nss-debuginfoUpgrade pki-serverUpgrade jss-debugsourceUpgrade pki-base-javaUpgrade slf4jUpgrade jakarta-commons-httpclientUpgrade xml-commons-apisUpgrade jackson-module-jaxb-annotationsUpgrade javassist-javadocUpgrade relaxngDatatypeUpgrade pki-kraUpgrade pki-caUpgrade pki-servlet-4.0-apiUpgrade xsomUpgrade pki-tools | Oct 4, 2021 | Mar 2, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 9, 2020 | Mar 2, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 2, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 2, 2020 |
| Redhat_linux | — | Upgrade jackson-jaxrs-json-providerUpgrade python-nss-docUpgrade jssUpgrade pki-core-debugsourceUpgrade pki-kraUpgrade jackson-databindUpgrade pki-servlet-4.0-apiUpgrade jss-debugsourceUpgrade pki-tools-debuginfoUpgrade xmlstreambufferUpgrade xsomUpgrade jackson-module-jaxb-annotationsUpgrade python3-nss-debuginfoUpgrade xml-commons-resolverUpgrade glassfish-jaxb-runtimeUpgrade pki-core-debuginfoUpgrade jackson-annotationsUpgrade xerces-j2Upgrade pki-baseUpgrade jackson-jaxrs-providersUpgrade python3-nssUpgrade pki-caUpgrade apache-commons-langUpgrade xml-commons-apisUpgrade jackson-coreUpgrade slf4j-jdk14Upgrade pki-toolsUpgrade ldapjdk-javadocUpgrade resteasyUpgrade javassistUpgrade glassfish-jaxb-apiUpgrade javassist-javadocUpgrade apache-commons-collectionsUpgrade pki-servlet-engineUpgrade relaxngDatatypeUpgrade velocityUpgrade glassfish-jaxb-txw2Upgrade jss-debuginfoUpgrade python3-pkiUpgrade bea-stax-apiUpgrade tomcatjssUpgrade slf4jUpgrade jss-javadocUpgrade glassfish-jaxb-coreUpgrade pki-serverUpgrade xalan-j2Upgrade stax-exUpgrade glassfish-fastinfosetUpgrade jakarta-commons-httpclientUpgrade python-nss-debugsourceUpgrade pki-symkey-debuginfoUpgrade ldapjdkUpgrade pki-symkeyUpgrade pki-base-java | Oct 4, 2021 | Mar 2, 2020 |
| Rocky_linux | — | Upgrade python-nss-docUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfoUpgrade python3-nss | Mar 12, 2024 | Mar 2, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub