FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Jackson-databind | Fasterxml | 2.0.0 (including) | 2.6.7.5 (excluding) |
Jackson-databind | Fasterxml | 2.7.0 (including) | 2.9.10.6 (excluding) |
OpenShift Logging 5.0 | RedHat | openshift-logging/elasticsearch6-rhel8:v5.0.3-1 | * |
Red Hat OpenShift Container Platform 4.6 | RedHat | openshift4/ose-logging-elasticsearch6:v4.6.0-202104161407.p0 | * |
Red Hat OpenShift Container Platform 4.7 | RedHat | openshift4/ose-metering-presto:v4.7.0-202102110027.p0 | * |
Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-maven35-jackson-databind-0:2.7.6-2.11.el7 | * |
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | RedHat | rh-maven35-jackson-databind-0:2.7.6-2.11.el7 | * |
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | rh-maven35-jackson-databind-0:2.7.6-2.11.el7 | * |
Jackson-databind | Ubuntu | bionic | * |
Jackson-databind | Ubuntu | focal | * |
Jackson-databind | Ubuntu | groovy | * |
Jackson-databind | Ubuntu | hirsute | * |
Jackson-databind | Ubuntu | impish | * |
Jackson-databind | Ubuntu | kinetic | * |
Jackson-databind | Ubuntu | lunar | * |
Jackson-databind | Ubuntu | mantic | * |
Jackson-databind | Ubuntu | oracular | * |
Jackson-databind | Ubuntu | trusty | * |
Jackson-databind | Ubuntu | trusty/esm | * |
Jackson-databind | Ubuntu | xenial | * |