Red Hat Security AdvisoryRHSA-2019:2804
Red Hat JBoss Fuse/A-MQ 6.3 R13 security and bug fix update
Released 2019-09-17 · Red Hat rating Important · View on Red Hat →
Fixes 10 records
Priority MEDIUM 63
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.12679 · Published 2019-01-02 · Partial fix · 2.9.7, 2.8.11.3 +2 CWE-502
Priority MEDIUM 61
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.09682 · Published 2019-01-02 · Partial fix · 2.9.7, 2.8.11.3 +1 CWE-502
Priority MEDIUM 57
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0573 · Published 2019-07-09 · Partial fix · 2.7.9.4, 2.8.11.2 +1 CWE-502
Priority MEDIUM 55
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.10599 · Published 2019-01-02 · Partial fix · 2.9.8, 2.8.11.3 +2 CWE-502
Priority MEDIUM 55
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.10599 · Published 2019-01-02 · Partial fix · 2.7.9.5, 2.9.8 +1 CWE-502
Priority MEDIUM 55
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.10599 · Published 2019-01-02 · Partial fix · 2.9.8, 2.8.11.3 +1 CWE-502
Priority MEDIUM 45
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6.
CVSS 3.1HIGH 7.5· Network · No auth · User interaction · EPSS 0.07289 · Published 2019-03-17 · Partial fix · 2.7.9.4, 2.8.11.2 +1 CWE-502
Priority MEDIUM 44
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6.
CVSS 3.0HIGH 7.5· Network · No auth · User interaction · EPSS 0.08872 · Published 2019-03-17 · Partial fix · 2.7.9.4, 2.8.11.2 +1 CWE-502
Priority MEDIUM 43
A flaw was found in Jolokia versions from 1.2 to before 1.6.1.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.02665 · Published 2019-08-01 · Partial fix · 1.6.1 CWE-20
Priority LOW 39
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.10902 · Published 2019-06-19 · Partial fix · 2.9.9.1, 2.8.11.4 +2 CWE-502
THREATIST.IORead the docs