FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade glassfish-jaxb-apiUpgrade xsomUpgrade glassfish-fastinfosetUpgrade javassistUpgrade glassfish-jaxb-txw2Upgrade python3-nssUpgrade javassist-javadocUpgrade python-nss-docUpgrade velocityUpgrade xalan-j2Upgrade jakarta-commons-httpclientUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-coreUpgrade slf4jUpgrade xml-commons-apisUpgrade slf4j-jdk14Upgrade xmlstreambufferUpgrade xerces-j2Upgrade jackson-jaxrs-providersUpgrade jackson-coreUpgrade apache-commons-langUpgrade xml-commons-resolverUpgrade glassfish-jaxb-runtimeUpgrade relaxngDatatypeUpgrade bea-stax-apiUpgrade jackson-annotationsUpgrade jackson-jaxrs-json-providerUpgrade jackson-databindUpgrade jackson-module-jaxb-annotationsUpgrade stax-ex | May 13, 2022 | Mar 2, 2020 |
| Centos_linux | — | Upgrade python3-pkiUpgrade resteasyUpgrade jackson-annotationsUpgrade slf4j-jdk14Upgrade apache-commons-collectionsUpgrade glassfish-jaxb-apiUpgrade velocityUpgrade slf4jUpgrade jackson-jaxrs-providersUpgrade jakarta-commons-httpclientUpgrade bea-stax-apiUpgrade jss-javadocUpgrade ldapjdk-javadocUpgrade pki-servlet-engineUpgrade ldapjdkUpgrade pki-toolsUpgrade pki-symkeyUpgrade jackson-module-jaxb-annotationsUpgrade pki-kraUpgrade python-nss-debugsourceUpgrade jss-debuginfoUpgrade tomcatjssUpgrade pki-symkey-debuginfoUpgrade stax-exUpgrade python3-nssUpgrade glassfish-fastinfosetUpgrade javassistUpgrade xerces-j2Upgrade pki-core-debugsourceUpgrade relaxngDatatypeUpgrade apache-commons-langUpgrade pki-base-javaUpgrade pki-baseUpgrade glassfish-jaxb-runtimeUpgrade xmlstreambufferUpgrade jssUpgrade pki-caUpgrade pki-core-debuginfoUpgrade pki-serverUpgrade pki-servlet-4.0-apiUpgrade jackson-databindUpgrade xml-commons-apisUpgrade xalan-j2Upgrade jss-debugsourceUpgrade python3-nss-debuginfoUpgrade glassfish-jaxb-txw2Upgrade jackson-coreUpgrade glassfish-jaxb-coreUpgrade pki-tools-debuginfoUpgrade xsomUpgrade xml-commons-resolverUpgrade python-nss-docUpgrade javassist-javadocUpgrade jackson-jaxrs-json-provider | Oct 4, 2021 | Mar 2, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 9, 2020 | Mar 2, 2020 |
| Freebsd | — | Upgrade puppetdb5 | Aug 11, 2020 | Aug 11, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 2, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 2, 2020 |
| Redhat_linux | — | Upgrade jackson-jaxrs-providersUpgrade ldapjdk-javadocUpgrade jss-javadocUpgrade stax-exUpgrade jackson-annotationsUpgrade jackson-module-jaxb-annotationsUpgrade jackson-coreUpgrade resteasyUpgrade jss-debuginfoUpgrade slf4j-jdk14Upgrade jss-debugsourceUpgrade pki-servlet-engineUpgrade slf4jUpgrade tomcatjssUpgrade pki-kraUpgrade xml-commons-apisUpgrade glassfish-jaxb-apiUpgrade relaxngDatatypeUpgrade jakarta-commons-httpclientUpgrade pki-symkey-debuginfoUpgrade pki-toolsUpgrade velocityUpgrade javassistUpgrade python-nss-debugsourceUpgrade pki-serverUpgrade apache-commons-langUpgrade glassfish-fastinfosetUpgrade xsomUpgrade pki-servlet-4.0-apiUpgrade apache-commons-collectionsUpgrade pki-core-debugsourceUpgrade pki-base-javaUpgrade xml-commons-resolverUpgrade python-nss-docUpgrade xalan-j2Upgrade python3-nss-debuginfoUpgrade pki-symkeyUpgrade xerces-j2Upgrade pki-caUpgrade pki-tools-debuginfoUpgrade javassist-javadocUpgrade glassfish-jaxb-runtimeUpgrade python3-nssUpgrade xmlstreambufferUpgrade jssUpgrade ldapjdkUpgrade pki-baseUpgrade glassfish-jaxb-coreUpgrade python3-pkiUpgrade pki-core-debuginfoUpgrade glassfish-jaxb-txw2Upgrade jackson-databindUpgrade jackson-jaxrs-json-providerUpgrade bea-stax-api | Oct 4, 2021 | Mar 2, 2020 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfoUpgrade python-nss-doc | Mar 12, 2024 | Mar 2, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub