FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade velocityUpgrade glassfish-jaxb-apiUpgrade javassistUpgrade xalan-j2Upgrade glassfish-jaxb-coreUpgrade apache-commons-collectionsUpgrade jakarta-commons-httpclientUpgrade glassfish-fastinfosetUpgrade xsomUpgrade python-nss-docUpgrade python3-nssUpgrade javassist-javadocUpgrade glassfish-jaxb-txw2Upgrade xml-commons-apisUpgrade jackson-databindUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-langUpgrade slf4jUpgrade glassfish-jaxb-runtimeUpgrade slf4j-jdk14Upgrade xerces-j2Upgrade jackson-jaxrs-providersUpgrade xmlstreambufferUpgrade xml-commons-resolverUpgrade jackson-annotationsUpgrade bea-stax-apiUpgrade relaxngDatatypeUpgrade jackson-jaxrs-json-providerUpgrade jackson-coreUpgrade stax-ex | May 13, 2022 | Mar 2, 2020 |
| Centos_linux | — | Upgrade xsomUpgrade jss-debugsourceUpgrade python-nss-docUpgrade xalan-j2Upgrade xml-commons-resolverUpgrade pki-servlet-4.0-apiUpgrade jackson-databindUpgrade jackson-jaxrs-json-providerUpgrade javassist-javadocUpgrade glassfish-jaxb-txw2Upgrade xml-commons-apisUpgrade python3-nss-debuginfoUpgrade jssUpgrade pki-tools-debuginfoUpgrade pki-caUpgrade pki-serverUpgrade glassfish-jaxb-coreUpgrade apache-commons-langUpgrade xmlstreambufferUpgrade relaxngDatatypeUpgrade pki-baseUpgrade jackson-coreUpgrade pki-core-debuginfoUpgrade glassfish-jaxb-runtimeUpgrade pki-core-debugsourceUpgrade pki-base-javaUpgrade xerces-j2Upgrade pki-servlet-engineUpgrade ldapjdkUpgrade slf4j-jdk14Upgrade ldapjdk-javadocUpgrade glassfish-fastinfosetUpgrade resteasyUpgrade jackson-jaxrs-providersUpgrade slf4jUpgrade velocityUpgrade pki-toolsUpgrade glassfish-jaxb-apiUpgrade python-nss-debugsourceUpgrade tomcatjssUpgrade pki-kraUpgrade jss-debuginfoUpgrade apache-commons-collectionsUpgrade python3-nssUpgrade jackson-annotationsUpgrade python3-pkiUpgrade stax-exUpgrade pki-symkey-debuginfoUpgrade pki-symkeyUpgrade jss-javadocUpgrade jakarta-commons-httpclientUpgrade jackson-module-jaxb-annotationsUpgrade bea-stax-apiUpgrade javassist | Oct 4, 2021 | Mar 2, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 9, 2020 | Mar 2, 2020 |
| Freebsd | — | Upgrade puppetdb5 | Aug 11, 2020 | Aug 11, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 2, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 2, 2020 |
| Redhat_linux | — | Upgrade jackson-databindUpgrade xml-commons-resolverUpgrade xerces-j2Upgrade pki-base-javaUpgrade pki-symkeyUpgrade glassfish-fastinfosetUpgrade python3-nss-debuginfoUpgrade ldapjdkUpgrade glassfish-jaxb-txw2Upgrade xalan-j2Upgrade python-nss-docUpgrade python3-nssUpgrade glassfish-jaxb-runtimeUpgrade xsomUpgrade python3-pkiUpgrade xmlstreambufferUpgrade glassfish-jaxb-coreUpgrade jssUpgrade pki-core-debuginfoUpgrade javassist-javadocUpgrade bea-stax-apiUpgrade pki-baseUpgrade pki-servlet-4.0-apiUpgrade pki-core-debugsourceUpgrade jackson-jaxrs-json-providerUpgrade pki-tools-debuginfoUpgrade pki-caUpgrade apache-commons-collectionsUpgrade jackson-module-jaxb-annotationsUpgrade jackson-coreUpgrade relaxngDatatypeUpgrade stax-exUpgrade pki-symkey-debuginfoUpgrade resteasyUpgrade python-nss-debugsourceUpgrade jakarta-commons-httpclientUpgrade velocityUpgrade jss-debugsourceUpgrade apache-commons-langUpgrade jackson-annotationsUpgrade pki-toolsUpgrade glassfish-jaxb-apiUpgrade jss-javadocUpgrade slf4j-jdk14Upgrade pki-serverUpgrade xml-commons-apisUpgrade pki-kraUpgrade jackson-jaxrs-providersUpgrade pki-servlet-engineUpgrade tomcatjssUpgrade ldapjdk-javadocUpgrade jss-debuginfoUpgrade javassistUpgrade slf4j | Oct 4, 2021 | Mar 2, 2020 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-docUpgrade python3-nss-debuginfoUpgrade python-nss-debugsource | Mar 12, 2024 | Mar 2, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub