FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Jackson-databind | Fasterxml | 2.6.0 (including) | 2.6.7.2 (including) |
| Jackson-databind | Fasterxml | 2.7.0 (including) | 2.7.9.5 (excluding) |
| Jackson-databind | Fasterxml | 2.8.0 (including) | 2.8.11.3 (excluding) |
| Jackson-databind | Fasterxml | 2.9.0 (including) | 2.9.8 (excluding) |
| OpenShift Logging 5.0 | RedHat | openshift-logging/elasticsearch6-rhel8:v5.0.3-1 | * |
| Red Hat Data Grid | RedHat | jackson-databind | * |
| Red Hat Fuse 6.3 | RedHat | jackson-databind | * |
| Red Hat Fuse 7.5.0 | RedHat | jackson-databind | * |
| Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R13 | RedHat | jackson-databind | * |
| Red Hat JBoss BPMS 6.4 | RedHat | jackson-databind | * |
| Red Hat JBoss BPMS 7.4 | RedHat | jackson-databind | * |
| Red Hat JBoss BRMS 6.4.12 | RedHat | jackson-databind | * |
| Red Hat JBoss BRMS 7.4 | RedHat | jackson-databind | * |
| Red Hat JBoss Data Virtualization 6.4.8 | RedHat | jackson-databind | * |
| Red Hat JBoss Enterprise Application Platform Continuous Delivery | RedHat | jackson-databind | * |
| Red Hat OpenShift Container Platform 3.11 | RedHat | openshift3/ose-logging-elasticsearch5:v3.11.153-2 | * |
| Red Hat OpenShift Container Platform 4.1 | RedHat | openshift4/ose-logging-elasticsearch5:v4.1.18-201909201915 | * |
| Red Hat OpenShift Container Platform 4.6 | RedHat | openshift4/ose-logging-elasticsearch6:v4.6.0-202104161407.p0 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-maven35-jackson-databind-0:2.7.6-2.5.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS | RedHat | rh-maven35-jackson-databind-0:2.7.6-2.5.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS | RedHat | rh-maven35-jackson-databind-0:2.7.6-2.5.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | RedHat | rh-maven35-jackson-databind-0:2.7.6-2.5.el7 | * |
| Text-Only RHOAR | RedHat | * | |
| Jackson-databind | Ubuntu | bionic | * |
| Jackson-databind | Ubuntu | cosmic | * |
| Jackson-databind | Ubuntu | devel | * |
| Jackson-databind | Ubuntu | disco | * |
| Jackson-databind | Ubuntu | eoan | * |
| Jackson-databind | Ubuntu | esm-apps/bionic | * |
| Jackson-databind | Ubuntu | esm-apps/focal | * |
| Jackson-databind | Ubuntu | esm-apps/jammy | * |
| Jackson-databind | Ubuntu | esm-apps/noble | * |
| Jackson-databind | Ubuntu | esm-apps/xenial | * |
| Jackson-databind | Ubuntu | focal | * |
| Jackson-databind | Ubuntu | groovy | * |
| Jackson-databind | Ubuntu | hirsute | * |
| Jackson-databind | Ubuntu | impish | * |
| Jackson-databind | Ubuntu | jammy | * |
| Jackson-databind | Ubuntu | kinetic | * |
| Jackson-databind | Ubuntu | lunar | * |
| Jackson-databind | Ubuntu | mantic | * |
| Jackson-databind | Ubuntu | noble | * |
| Jackson-databind | Ubuntu | oracular | * |
| Jackson-databind | Ubuntu | plucky | * |
| Jackson-databind | Ubuntu | trusty | * |
| Jackson-databind | Ubuntu | trusty/esm | * |
| Jackson-databind | Ubuntu | upstream | * |
| Jackson-databind | Ubuntu | xenial | * |