A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-jaxrs-json-providerUpgrade xalan-j2Upgrade jackson-coreUpgrade xerces-j2Upgrade xsomUpgrade apache-commons-langUpgrade xml-commons-resolverUpgrade python-nss-docUpgrade javassist-javadocUpgrade relaxngDatatypeUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-coreUpgrade xmlstreambufferUpgrade xml-commons-apisUpgrade glassfish-jaxb-runtimeUpgrade jackson-databindUpgrade javassistUpgrade glassfish-jaxb-apiUpgrade velocityUpgrade jakarta-commons-httpclientUpgrade stax-exUpgrade jackson-jaxrs-providersUpgrade jackson-module-jaxb-annotationsUpgrade slf4jUpgrade python3-nssUpgrade jackson-annotationsUpgrade glassfish-fastinfosetUpgrade slf4j-jdk14Upgrade bea-stax-apiUpgrade apache-commons-collections | May 4, 2022 | Oct 1, 2019 |
| Centos_linux | — | Upgrade python3-nss-debuginfoUpgrade jssUpgrade jss-debuginfoUpgrade jackson-coreUpgrade pki-core-debuginfoUpgrade pki-kraUpgrade xmlstreambufferUpgrade jackson-databindUpgrade jackson-jaxrs-json-providerUpgrade pki-baseUpgrade python-nss-debugsourceUpgrade xsomUpgrade python-nss-docUpgrade jackson-jaxrs-providersUpgrade xml-commons-apisUpgrade xerces-j2Upgrade pki-core-debugsourceUpgrade pki-servlet-4.0-apiUpgrade stax-exUpgrade pki-toolsUpgrade xml-commons-resolverUpgrade glassfish-jaxb-runtimeUpgrade slf4j-jdk14Upgrade python3-nssUpgrade pki-caUpgrade pki-symkeyUpgrade apache-commons-collectionsUpgrade python3-pkiUpgrade ldapjdkUpgrade relaxngDatatypeUpgrade ldapjdk-javadocUpgrade pki-symkey-debuginfoUpgrade glassfish-fastinfosetUpgrade jss-javadocUpgrade jackson-annotationsUpgrade glassfish-jaxb-apiUpgrade tomcatjssUpgrade pki-servlet-engineUpgrade velocityUpgrade pki-serverUpgrade javassistUpgrade pki-tools-debuginfoUpgrade glassfish-jaxb-txw2Upgrade resteasyUpgrade javassist-javadocUpgrade jss-debugsourceUpgrade pki-base-javaUpgrade slf4jUpgrade xalan-j2Upgrade apache-commons-langUpgrade glassfish-jaxb-coreUpgrade bea-stax-apiUpgrade jackson-module-jaxb-annotationsUpgrade jakarta-commons-httpclient | Apr 29, 2020 | Oct 1, 2019 |
| Debian | — | Upgrade jackson-databind | Oct 4, 2019 | Oct 1, 2019 |
| Oracle Missing Cpu Jul 2020 | oracle-apply-jul-2020-cpu | Jul 14, 2020 | Oct 1, 2019 | |
| Oracle Weblogic | oracle-weblogic-apr-2020-cpu-12_2_1_3_0oracle-weblogic-apr-2020-cpu-12_2_1_4_0 | Apr 25, 2024 | Oct 1, 2019 | |
| Oracle_linux | — | oracle-linux-upgrade-apache-commons-collectionsoracle-linux-upgrade-apache-commons-langoracle-linux-upgrade-bea-stax-apioracle-linux-upgrade-glassfish-fastinfosetoracle-linux-upgrade-glassfish-jaxb-apioracle-linux-upgrade-glassfish-jaxb-coreoracle-linux-upgrade-glassfish-jaxb-runtimeoracle-linux-upgrade-glassfish-jaxb-txw2oracle-linux-upgrade-jackson-annotationsoracle-linux-upgrade-jackson-coreoracle-linux-upgrade-jackson-databindoracle-linux-upgrade-jackson-jaxrs-json-provideroracle-linux-upgrade-jackson-jaxrs-providersoracle-linux-upgrade-jackson-module-jaxb-annotationsoracle-linux-upgrade-jakarta-commons-httpclientoracle-linux-upgrade-javassistoracle-linux-upgrade-javassist-javadocoracle-linux-upgrade-jssoracle-linux-upgrade-jss-javadocoracle-linux-upgrade-ldapjdkoracle-linux-upgrade-ldapjdk-javadocoracle-linux-upgrade-pki-baseoracle-linux-upgrade-pki-base-javaoracle-linux-upgrade-pki-caoracle-linux-upgrade-pki-kraoracle-linux-upgrade-pki-serveroracle-linux-upgrade-pki-servlet-4-0-apioracle-linux-upgrade-pki-servlet-engineoracle-linux-upgrade-pki-symkeyoracle-linux-upgrade-pki-toolsoracle-linux-upgrade-python3-nssoracle-linux-upgrade-python3-pkioracle-linux-upgrade-python-nss-docoracle-linux-upgrade-relaxngdatatypeoracle-linux-upgrade-resteasyoracle-linux-upgrade-slf4joracle-linux-upgrade-slf4j-jdk14oracle-linux-upgrade-stax-exoracle-linux-upgrade-tomcatjssoracle-linux-upgrade-velocityoracle-linux-upgrade-xalan-j2oracle-linux-upgrade-xerces-j2oracle-linux-upgrade-xml-commons-apisoracle-linux-upgrade-xml-commons-resolveroracle-linux-upgrade-xmlstreambufferoracle-linux-upgrade-xsom | Jul 22, 2024 | Sep 27, 2019 |
| Red Hat Jboss Eap | red-hat-jboss-eap-upgrade-latest | Sep 19, 2024 | Sep 27, 2019 | |
| Redhat_linux | redhat-upgrade-apache-commons-collectionsredhat-upgrade-apache-commons-langredhat-upgrade-bea-stax-apiredhat-upgrade-glassfish-fastinfosetredhat-upgrade-glassfish-jaxb-apiredhat-upgrade-glassfish-jaxb-coreredhat-upgrade-glassfish-jaxb-runtimeredhat-upgrade-glassfish-jaxb-txw2redhat-upgrade-jackson-annotationsredhat-upgrade-jackson-coreredhat-upgrade-jackson-databindredhat-upgrade-jackson-jaxrs-json-providerredhat-upgrade-jackson-jaxrs-providersredhat-upgrade-jackson-module-jaxb-annotationsredhat-upgrade-jakarta-commons-httpclientredhat-upgrade-javassistredhat-upgrade-javassist-javadocredhat-upgrade-jssredhat-upgrade-jss-debuginforedhat-upgrade-jss-debugsourceredhat-upgrade-jss-javadocredhat-upgrade-ldapjdkredhat-upgrade-ldapjdk-javadocredhat-upgrade-pki-baseredhat-upgrade-pki-base-javaredhat-upgrade-pki-caredhat-upgrade-pki-core-debuginforedhat-upgrade-pki-core-debugsourceredhat-upgrade-pki-kraredhat-upgrade-pki-serverredhat-upgrade-pki-servlet-4-0-apiredhat-upgrade-pki-servlet-engineredhat-upgrade-pki-symkeyredhat-upgrade-pki-symkey-debuginforedhat-upgrade-pki-toolsredhat-upgrade-pki-tools-debuginforedhat-upgrade-python-nss-debugsourceredhat-upgrade-python-nss-docredhat-upgrade-python3-nssredhat-upgrade-python3-nss-debuginforedhat-upgrade-python3-pkiredhat-upgrade-relaxngdatatyperedhat-upgrade-resteasyredhat-upgrade-slf4jredhat-upgrade-slf4j-jdk14redhat-upgrade-stax-exredhat-upgrade-tomcatjssredhat-upgrade-velocityredhat-upgrade-xalan-j2redhat-upgrade-xerces-j2redhat-upgrade-xml-commons-apisredhat-upgrade-xml-commons-resolverredhat-upgrade-xmlstreambufferredhat-upgrade-xsom | Apr 29, 2020 | Oct 1, 2019 | |
| Rocky_linux | rocky-upgrade-python-nss-debugsourcerocky-upgrade-python-nss-docrocky-upgrade-python3-nssrocky-upgrade-python3-nss-debuginfo | Mar 12, 2024 | Oct 1, 2019 | |
| Suse | — | suse-upgrade-jackson-databind | Feb 4, 2022 | Oct 1, 2019 |
| Ubuntu | ubuntu-pro-upgrade-libjackson2-databind-java | Mar 22, 2023 | Oct 1, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub