A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Jackson-databind | Fasterxml | 2.0.0 (including) | 2.6.7.3 (excluding) |
| Jackson-databind | Fasterxml | 2.8.0 (including) | 2.8.11.5 (excluding) |
| Jackson-databind | Fasterxml | 2.9.0 (including) | 2.9.10.1 (excluding) |
| EAP-CD 19 Tech Preview | RedHat | jackson-databind | * |
| Red Hat AMQ Streams 1 | RedHat | jackson-databind | * |
| Red Hat Data Grid 7.3.6 | RedHat | jackson-databind | * |
| Red Hat Decision Manager 7 | RedHat | jackson-databind | * |
| Red Hat Enterprise Linux 8 | RedHat | pki-core:10.6-8020020200326162741.c7c3114f | * |
| Red Hat Enterprise Linux 8 | RedHat | pki-deps:10.6-8020020191204213056.6a468ee4 | * |
| Red Hat Fuse 7.7.0 | RedHat | jackson-databind | * |
| Red Hat JBoss EAP 7.2 | RedHat | jackson-databind | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-apache-cxf-0:3.2.11-1.redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-glassfish-jsf-0:2.3.5-6.SP3_redhat_00004.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-hal-console-0:3.0.19-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-hibernate-0:5.3.14-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-hibernate-validator-0:6.0.18-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jackson-annotations-0:2.9.10-1.redhat_00003.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jackson-core-0:2.9.10-1.redhat_00003.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jackson-databind-0:2.9.10.1-1.redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jackson-dataformats-binary-0:2.9.10-1.redhat_00003.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jackson-dataformats-text-0:2.9.10-1.redhat_00003.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jackson-jaxrs-providers-0:2.9.10-1.redhat_00003.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jackson-modules-base-0:2.9.10-2.redhat_00003.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jackson-modules-java8-0:2.9.10-1.redhat_00003.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jberet-0:1.3.5-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jboss-ejb-client-0:4.0.27-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jboss-jsf-api_2.3_spec-0:2.3.5-3.SP2_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jboss-server-migration-0:1.3.1-7.Final_redhat_00007.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-jboss-xnio-base-0:3.7.6-3.SP2_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-netty-0:4.1.42-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-picketlink-bindings-0:2.5.5-21.SP12_redhat_00010.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-undertow-0:2.0.28-2.SP1_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-undertow-jastow-0:2.0.8-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-weld-core-0:3.0.6-3.Final_redhat_00003.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-wildfly-0:7.2.6-5.GA_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-wildfly-http-client-0:1.0.18-2.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | RedHat | eap7-wildfly-transaction-client-0:1.1.8-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-apache-cxf-0:3.2.11-1.redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-glassfish-jsf-0:2.3.5-6.SP3_redhat_00004.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-hal-console-0:3.0.19-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-hibernate-0:5.3.14-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-hibernate-validator-0:6.0.18-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jackson-annotations-0:2.9.10-1.redhat_00003.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jackson-core-0:2.9.10-1.redhat_00003.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jackson-databind-0:2.9.10.1-1.redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jackson-dataformats-binary-0:2.9.10-1.redhat_00003.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jackson-dataformats-text-0:2.9.10-1.redhat_00003.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jackson-jaxrs-providers-0:2.9.10-1.redhat_00003.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jackson-modules-base-0:2.9.10-2.redhat_00003.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jackson-modules-java8-0:2.9.10-1.redhat_00003.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jberet-0:1.3.5-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jboss-ejb-client-0:4.0.27-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jboss-jsf-api_2.3_spec-0:2.3.5-3.SP2_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jboss-server-migration-0:1.3.1-7.Final_redhat_00007.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-jboss-xnio-base-0:3.7.6-3.SP2_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-netty-0:4.1.42-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-picketlink-bindings-0:2.5.5-21.SP12_redhat_00010.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-undertow-0:2.0.28-2.SP1_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-undertow-jastow-0:2.0.8-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-weld-core-0:3.0.6-3.Final_redhat_00003.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-wildfly-0:7.2.6-5.GA_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-wildfly-http-client-0:1.0.18-2.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | RedHat | eap7-wildfly-transaction-client-0:1.1.8-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-apache-cxf-0:3.2.11-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-glassfish-jsf-0:2.3.5-6.SP3_redhat_00004.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-hal-console-0:3.0.19-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-hibernate-0:5.3.14-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-hibernate-validator-0:6.0.18-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-jackson-annotations-0:2.9.10-1.redhat_00003.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-jackson-core-0:2.9.10-1.redhat_00003.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-jackson-databind-0:2.9.10.1-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-jackson-dataformats-binary-0:2.9.10-1.redhat_00003.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-jackson-dataformats-text-0:2.9.10-1.redhat_00003.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-jackson-jaxrs-providers-0:2.9.10-1.redhat_00003.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-jackson-modules-base-0:2.9.10-2.redhat_00003.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-jackson-modules-java8-0:2.9.10-1.redhat_00003.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-jberet-0:1.3.5-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-jboss-ejb-client-0:4.0.27-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-jboss-jsf-api_2.3_spec-0:2.3.5-3.SP2_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-jboss-server-migration-0:1.3.1-7.Final_redhat_00007.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-jboss-xnio-base-0:3.7.6-3.SP2_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-netty-0:4.1.42-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-picketlink-bindings-0:2.5.5-21.SP12_redhat_00010.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-undertow-0:2.0.28-2.SP1_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-undertow-jastow-0:2.0.8-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-weld-core-0:3.0.6-3.Final_redhat_00003.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-wildfly-0:7.2.6-5.GA_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-wildfly-http-client-0:1.0.18-2.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | RedHat | eap7-wildfly-transaction-client-0:1.1.8-1.Final_redhat_00001.1.el8eap | * |
| Red Hat Openshift Application Runtimes Vert.x 3.8.3 | RedHat | jackson-databind | * |
| Red Hat Process Automation 7 | RedHat | jackson-databind | * |
| Red Hat Single Sign-On 7.3 | RedHat | jackson-databind | * |
| Text-Only RHOAR | RedHat | * | |
| Jackson-databind | Ubuntu | bionic | * |
| Jackson-databind | Ubuntu | disco | * |
| Jackson-databind | Ubuntu | eoan | * |
| Jackson-databind | Ubuntu | esm-apps/xenial | * |
| Jackson-databind | Ubuntu | trusty | * |
| Jackson-databind | Ubuntu | trusty/esm | * |
| Jackson-databind | Ubuntu | xenial | * |