| Package | Affected versions | Patched versions |
|---|---|---|
| com.fasterxml.jackson.core:jackson-databind | ≥ 2.0.0, < 2.7.9.5≥ 2.8.0, < 2.8.11.3≥ 2.9.0, < 2.9.7 | 2.7.9.52.8.11.32.9.7 |
| jackson-databind | ≥ 2.0.0, < 2.6.7.3≥ 2.7.0, < 2.7.9.5≥ 2.8.0, < 2.8.11.3≥ 2.9.0, < 2.9.7 | 2.6.7.32.7.9.52.8.11.32.9.7 |
| banking platform | = 2.5.0= 2.6.0= 2.6.1= 2.6.2 | |
| business process management suite | = 12.1.3.0.0= 12.2.1.3.0 | |
| clusterware | = 12.1.0.2.0 | |
| communications billing and revenue management | = 12.0= 7.5 | |
| database server | = 11.2.0.4= 12.1.0.2= 12.2.0.1= 18c= 19c | |
| enterprise manager for virtualization | = 13.2.2= 13.2.3= 13.3.1 | |
| financial services analytical applications infrastructure | = 8.0.2= 8.0.3= 8.0.4= 8.0.5= 8.0.6= 8.0.7 | |
| global lifecycle management opatch | ≥ 12.2.0.1.0, < 12.2.0.1.19≥ 13.9.4.0.0, < 13.9.4.2.1< 11.2.0.3.23 | 12.2.0.1.1913.9.4.2.111.2.0.3.23 |
| jdeveloper | = 12.1.3.0.0= 12.2.1.3.0 | |
| primavera p6 enterprise project portfolio management | = 15.1= 15.2= 16.1= 16.2= 18.8≥ 17.7, ≤ 17.12 | |
| primavera unifier | = 16.1= 16.2= 18.8≥ 17.7, ≤ 17.12 | |
| retail merchandising system | = 15.0= 16.0 | |
| retail workforce management software | = 1.60.9.0.0 | |
| webcenter portal | = 12.2.1.3.0 | |
| openshift container platform | ≥ 3.11, < 3.11.153≥ 4.1, < 4.1.18≥ 4.6, < 4.6.26 | 3.11.1534.1.184.6.26 |
FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, and 2.7.9.5 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free