FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xsomUpgrade javassist-javadocUpgrade apache-commons-collectionsUpgrade python-nss-docUpgrade glassfish-jaxb-coreUpgrade velocityUpgrade glassfish-jaxb-apiUpgrade xalan-j2Upgrade glassfish-fastinfosetUpgrade python3-nssUpgrade javassistUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-txw2Upgrade jackson-module-jaxb-annotationsUpgrade jackson-annotationsUpgrade slf4jUpgrade jackson-jaxrs-json-providerUpgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-runtimeUpgrade xmlstreambufferUpgrade xml-commons-apisUpgrade xerces-j2Upgrade xml-commons-resolverUpgrade stax-exUpgrade jackson-coreUpgrade jackson-databindUpgrade slf4j-jdk14Upgrade apache-commons-langUpgrade bea-stax-apiUpgrade relaxngDatatype | May 13, 2022 | Mar 2, 2020 |
| Centos_linux | — | Upgrade xsomUpgrade xerces-j2Upgrade python3-nss-debuginfoUpgrade glassfish-jaxb-txw2Upgrade xmlstreambufferUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-apisUpgrade pki-baseUpgrade relaxngDatatypeUpgrade pki-base-javaUpgrade xalan-j2Upgrade jss-debugsourceUpgrade pki-servlet-4.0-apiUpgrade pki-serverUpgrade glassfish-jaxb-coreUpgrade xml-commons-resolverUpgrade jackson-databindUpgrade pki-tools-debuginfoUpgrade jackson-jaxrs-json-providerUpgrade javassist-javadocUpgrade apache-commons-langUpgrade pki-core-debugsourceUpgrade jssUpgrade pki-caUpgrade python-nss-docUpgrade jackson-coreUpgrade pki-core-debuginfoUpgrade glassfish-fastinfosetUpgrade apache-commons-collectionsUpgrade ldapjdkUpgrade jackson-module-jaxb-annotationsUpgrade bea-stax-apiUpgrade jss-debuginfoUpgrade pki-kraUpgrade tomcatjssUpgrade pki-symkey-debuginfoUpgrade pki-symkeyUpgrade python3-pkiUpgrade stax-exUpgrade pki-servlet-engineUpgrade velocityUpgrade glassfish-jaxb-apiUpgrade ldapjdk-javadocUpgrade resteasyUpgrade slf4jUpgrade python3-nssUpgrade python-nss-debugsourceUpgrade jackson-annotationsUpgrade jackson-jaxrs-providersUpgrade pki-toolsUpgrade jss-javadocUpgrade javassistUpgrade jakarta-commons-httpclientUpgrade slf4j-jdk14 | Oct 4, 2021 | Mar 2, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 9, 2020 | Mar 2, 2020 |
| Freebsd | — | Upgrade puppetdb5 | Aug 11, 2020 | Aug 11, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 2, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 2, 2020 |
| Redhat_linux | — | Upgrade pki-serverUpgrade apache-commons-langUpgrade resteasyUpgrade pki-kraUpgrade stax-exUpgrade javassistUpgrade pki-servlet-engineUpgrade tomcatjssUpgrade jss-debuginfoUpgrade python-nss-debugsourceUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-apiUpgrade velocityUpgrade jackson-coreUpgrade xml-commons-apisUpgrade jss-javadocUpgrade jackson-annotationsUpgrade slf4jUpgrade jss-debugsourceUpgrade jackson-jaxrs-providersUpgrade slf4j-jdk14Upgrade pki-toolsUpgrade ldapjdk-javadocUpgrade jakarta-commons-httpclientUpgrade relaxngDatatypeUpgrade pki-symkey-debuginfoUpgrade bea-stax-apiUpgrade python-nss-docUpgrade jssUpgrade jackson-jaxrs-json-providerUpgrade pki-core-debuginfoUpgrade python3-pkiUpgrade xsomUpgrade xalan-j2Upgrade javassist-javadocUpgrade apache-commons-collectionsUpgrade pki-core-debugsourceUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-runtimeUpgrade pki-baseUpgrade pki-base-javaUpgrade pki-caUpgrade pki-tools-debuginfoUpgrade pki-servlet-4.0-apiUpgrade glassfish-fastinfosetUpgrade xerces-j2Upgrade jackson-databindUpgrade python3-nss-debuginfoUpgrade pki-symkeyUpgrade xml-commons-resolverUpgrade xmlstreambufferUpgrade ldapjdkUpgrade python3-nssUpgrade glassfish-jaxb-core | Oct 4, 2021 | Mar 2, 2020 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-docUpgrade python3-nss-debuginfoUpgrade python-nss-debugsource | Mar 12, 2024 | Mar 2, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub