An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Jackson-databind | Fasterxml | 2.0.0 (including) | 2.6.7.3 (excluding) |
| Jackson-databind | Fasterxml | 2.7.0 (including) | 2.7.9.4 (excluding) |
| Jackson-databind | Fasterxml | 2.8.0 (including) | 2.8.11.2 (excluding) |
| Jackson-databind | Fasterxml | 2.9.0 (including) | 2.9.6 (excluding) |
| Red Hat Data Grid | RedHat | jackson-databind | * |
| Red Hat Fuse 6.3 | RedHat | jackson-databind | * |
| Red Hat Fuse 7.5.0 | RedHat | jackson-databind | * |
| Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R13 | RedHat | jackson-databind | * |
| Red Hat JBoss BPMS 7.4 | RedHat | jackson-databind | * |
| Red Hat JBoss BRMS 7.4 | RedHat | jackson-databind | * |
| Red Hat JBoss Data Virtualization 6.4.8 | RedHat | jackson-databind | * |
| Red Hat JBoss EAP 7.2 | RedHat | jackson-databind | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-activemq-artemis-0:2.6.3-5.redhat_00020.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-apache-commons-lang-0:3.8.0-1.redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-apache-cxf-0:3.2.7-1.redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-apache-cxf-xjc-utils-0:3.2.3-2.redhat_00002.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-artemis-native-0:2.6.3-15.redhat_00020.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-byte-buddy-0:1.9.5-1.redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-dom4j-0:2.1.1-2.redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-elytron-web-0:1.2.4-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-hibernate-0:5.3.9-2.Final_redhat_00002.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-httpcomponents-asyncclient-0:4.1.4-1.redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-infinispan-0:9.3.6-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-ironjacamar-0:1.4.15-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jackson-annotations-0:2.9.8-2.redhat_00004.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jackson-core-0:2.9.8-2.redhat_00004.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jackson-databind-0:2.9.8-2.redhat_00004.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jackson-jaxrs-providers-0:2.9.8-2.redhat_00004.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jackson-modules-base-0:2.9.8-1.redhat_00004.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jackson-modules-java8-0:2.9.8-1.redhat_00004.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jberet-0:1.3.2-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jboss-ejb-client-0:4.0.15-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jboss-el-api_3.0_spec-0:1.0.13-2.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jboss-genericjms-0:2.0.1-2.Final_redhat_00002.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jboss-logmanager-0:2.1.7-3.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jboss-remoting-jmx-0:3.0.1-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jboss-security-negotiation-0:3.0.5-2.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jboss-server-migration-0:1.3.0-7.Final_redhat_00004.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-narayana-0:5.9.1-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-picketlink-bindings-0:2.5.5-16.SP12_redhat_4.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-picketlink-federation-0:2.5.5-16.SP12_redhat_4.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-resteasy-0:3.6.1-4.SP3_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-sun-istack-commons-0:3.0.7-2.redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-undertow-0:2.0.19-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-undertow-jastow-0:2.0.7-2.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-wildfly-0:7.2.1-6.GA_redhat_00004.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-wildfly-elytron-0:1.6.2-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-wildfly-elytron-tool-0:1.4.1-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-wildfly-http-client-0:1.0.13-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-wildfly-transaction-client-0:1.1.3-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-yasson-0:1.0.2-1.redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-activemq-artemis-0:2.6.3-5.redhat_00020.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-apache-commons-lang-0:3.8.0-1.redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-apache-cxf-0:3.2.7-1.redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-apache-cxf-xjc-utils-0:3.2.3-2.redhat_00002.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-artemis-native-0:2.6.3-15.redhat_00020.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-byte-buddy-0:1.9.5-1.redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-dom4j-0:2.1.1-2.redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-elytron-web-0:1.2.4-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-hibernate-0:5.3.9-2.Final_redhat_00002.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-httpcomponents-asyncclient-0:4.1.4-1.redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-infinispan-0:9.3.6-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-ironjacamar-0:1.4.15-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jackson-annotations-0:2.9.8-2.redhat_00004.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jackson-core-0:2.9.8-2.redhat_00004.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jackson-databind-0:2.9.8-2.redhat_00004.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jackson-jaxrs-providers-0:2.9.8-2.redhat_00004.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jackson-modules-base-0:2.9.8-1.redhat_00004.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jackson-modules-java8-0:2.9.8-1.redhat_00004.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jberet-0:1.3.2-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jboss-ejb-client-0:4.0.15-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jboss-el-api_3.0_spec-0:1.0.13-2.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jboss-genericjms-0:2.0.1-2.Final_redhat_00002.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jboss-logmanager-0:2.1.7-3.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jboss-remoting-jmx-0:3.0.1-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jboss-security-negotiation-0:3.0.5-2.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jboss-server-migration-0:1.3.0-7.Final_redhat_00004.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-narayana-0:5.9.1-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-picketlink-bindings-0:2.5.5-16.SP12_redhat_4.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-picketlink-federation-0:2.5.5-16.SP12_redhat_4.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-resteasy-0:3.6.1-4.SP3_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-sun-istack-commons-0:3.0.7-2.redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-undertow-0:2.0.19-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-undertow-jastow-0:2.0.7-2.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-wildfly-0:7.2.1-6.GA_redhat_00004.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-wildfly-elytron-0:1.6.2-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-wildfly-elytron-tool-0:1.4.1-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-wildfly-http-client-0:1.0.13-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-wildfly-transaction-client-0:1.1.3-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-yasson-0:1.0.2-1.redhat_00001.1.el7eap | * |
| Red Hat OpenShift Container Platform 3.11 | RedHat | openshift3/ose-logging-elasticsearch5:v3.11.153-2 | * |
| Red Hat OpenShift Container Platform 4.1 | RedHat | openshift4/ose-logging-elasticsearch5:v4.1.18-201909201915 | * |
| Red Hat Single Sign-On 7.3.1 zip | RedHat | jackson-databind | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-maven35-jackson-databind-0:2.7.6-2.5.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS | RedHat | rh-maven35-jackson-databind-0:2.7.6-2.5.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS | RedHat | rh-maven35-jackson-databind-0:2.7.6-2.5.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | RedHat | rh-maven35-jackson-databind-0:2.7.6-2.5.el7 | * |
| Text-Only RHOAR | RedHat | * | |
| Jackson-databind | Ubuntu | cosmic | * |
| Jackson-databind | Ubuntu | esm-apps/xenial | * |
| Jackson-databind | Ubuntu | esm-infra-legacy/trusty | * |
| Jackson-databind | Ubuntu | trusty | * |
| Jackson-databind | Ubuntu | trusty/esm | * |
| Jackson-databind | Ubuntu | upstream | * |
| Jackson-databind | Ubuntu | xenial | * |