FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade velocityUpgrade javassist-javadocUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-txw2Upgrade xalan-j2Upgrade apache-commons-collectionsUpgrade glassfish-jaxb-apiUpgrade python3-nssUpgrade xsomUpgrade jakarta-commons-httpclientUpgrade javassistUpgrade glassfish-fastinfosetUpgrade python-nss-docUpgrade jackson-databindUpgrade slf4jUpgrade xml-commons-apisUpgrade jackson-jaxrs-providersUpgrade xml-commons-resolverUpgrade jackson-coreUpgrade slf4j-jdk14Upgrade apache-commons-langUpgrade jackson-module-jaxb-annotationsUpgrade bea-stax-apiUpgrade glassfish-jaxb-runtimeUpgrade xmlstreambufferUpgrade jackson-annotationsUpgrade jackson-jaxrs-json-providerUpgrade relaxngDatatypeUpgrade xerces-j2Upgrade stax-ex | May 13, 2022 | Mar 2, 2020 |
| Centos_linux | — | Upgrade jss-debuginfoUpgrade python-nss-debugsourceUpgrade glassfish-jaxb-apiUpgrade apache-commons-collectionsUpgrade pki-kraUpgrade stax-exUpgrade jackson-annotationsUpgrade python3-pkiUpgrade javassistUpgrade bea-stax-apiUpgrade pki-symkeyUpgrade pki-symkey-debuginfoUpgrade jss-javadocUpgrade pki-toolsUpgrade slf4j-jdk14Upgrade jackson-module-jaxb-annotationsUpgrade tomcatjssUpgrade jakarta-commons-httpclientUpgrade slf4jUpgrade python3-nssUpgrade jackson-jaxrs-providersUpgrade ldapjdk-javadocUpgrade glassfish-fastinfosetUpgrade pki-servlet-engineUpgrade velocityUpgrade ldapjdkUpgrade resteasyUpgrade python-nss-docUpgrade pki-serverUpgrade glassfish-jaxb-txw2Upgrade xerces-j2Upgrade pki-caUpgrade jssUpgrade javassist-javadocUpgrade jackson-jaxrs-json-providerUpgrade apache-commons-langUpgrade glassfish-jaxb-coreUpgrade pki-core-debugsourceUpgrade xalan-j2Upgrade xml-commons-apisUpgrade pki-servlet-4.0-apiUpgrade jackson-databindUpgrade relaxngDatatypeUpgrade pki-core-debuginfoUpgrade jackson-coreUpgrade pki-tools-debuginfoUpgrade python3-nss-debuginfoUpgrade xsomUpgrade pki-base-javaUpgrade pki-baseUpgrade glassfish-jaxb-runtimeUpgrade xmlstreambufferUpgrade xml-commons-resolverUpgrade jss-debugsource | Oct 4, 2021 | Mar 2, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 9, 2020 | Mar 2, 2020 |
| Freebsd | — | Upgrade puppetdb5 | Aug 11, 2020 | Aug 11, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 2, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 2, 2020 |
| Redhat_linux | — | Upgrade python3-nssUpgrade ldapjdkUpgrade pki-symkeyUpgrade glassfish-jaxb-runtimeUpgrade pki-core-debuginfoUpgrade jackson-databindUpgrade xerces-j2Upgrade python3-nss-debuginfoUpgrade python3-pkiUpgrade python-nss-docUpgrade glassfish-jaxb-txw2Upgrade bea-stax-apiUpgrade xalan-j2Upgrade xmlstreambufferUpgrade jssUpgrade glassfish-fastinfosetUpgrade xml-commons-resolverUpgrade pki-servlet-4.0-apiUpgrade pki-core-debugsourceUpgrade jackson-jaxrs-json-providerUpgrade pki-baseUpgrade javassist-javadocUpgrade pki-caUpgrade xsomUpgrade pki-base-javaUpgrade glassfish-jaxb-coreUpgrade apache-commons-collectionsUpgrade pki-tools-debuginfoUpgrade glassfish-jaxb-apiUpgrade relaxngDatatypeUpgrade velocityUpgrade pki-toolsUpgrade pki-serverUpgrade apache-commons-langUpgrade pki-symkey-debuginfoUpgrade jakarta-commons-httpclientUpgrade jss-debugsourceUpgrade pki-kraUpgrade jackson-annotationsUpgrade tomcatjssUpgrade slf4jUpgrade jss-javadocUpgrade slf4j-jdk14Upgrade javassistUpgrade jackson-module-jaxb-annotationsUpgrade stax-exUpgrade jackson-coreUpgrade jss-debuginfoUpgrade resteasyUpgrade python-nss-debugsourceUpgrade xml-commons-apisUpgrade jackson-jaxrs-providersUpgrade pki-servlet-engineUpgrade ldapjdk-javadoc | Oct 4, 2021 | Mar 2, 2020 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade python-nss-doc | Mar 12, 2024 | Mar 2, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub