Red Hat Security AdvisoryRHSA-2020:1523
rh-maven35-jackson-databind security update
Released 2020-04-21 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-maven35-jackson-databind-2.7.6-2.9.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.9.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-maven35-jackson-databind-2.7.6-2.9.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.9.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-maven35-jackson-databind-2.7.6-2.9.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.9.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-maven35-jackson-databind-2.7.6-2.9.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.9.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-maven35-jackson-databind-2.7.6-2.9.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.9.el7
Fixes 5 records
Priority MEDIUM 49
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.06278 · Published 2020-03-31 · Partial fix · 2.9.10.4 CWE-502
Priority MEDIUM 46
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.03643 · Published 2020-03-31 · Partial fix · 2.9.10.4 CWE-502
Priority MEDIUM 46
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms)…
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.03606 · Published 2020-03-31 · Partial fix · 2.9.10.4 CWE-502
Priority MEDIUM 46
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.0356 · Published 2020-03-26 · Partial fix · 2.9.10.4 CWE-502
Priority MEDIUM 46
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.03656 · Published 2020-03-26 · Partial fix · 2.9.10.4 CWE-502
THREATIST.IORead the docs