| Package | Affected versions | Patched versions |
|---|---|---|
| com.fasterxml.jackson.core:jackson-databind | ≥ 2.7.0, < 2.7.9.5≥ 2.8.0, < 2.8.11.3≥ 2.9.0, < 2.9.7 | 2.7.9.52.8.11.32.9.7 |
| jackson-databind | = 2.7.0= 2.8.0= 2.9.0≥ 2.6.0, < 2.6.7.2≥ 2.7.0, < 2.7.9.5≥ 2.8.0, < 2.8.11.3≥ 2.9.0, < 2.9.7 | 2.6.7.22.7.9.52.8.11.32.9.7 |
| banking platform | = 2.5.0= 2.6.0= 2.6.1= 2.6.2 | |
| communications billing and revenue management | = 12.0= 7.5 | |
| enterprise manager for virtualization | = 13.2.2= 13.2.3= 13.3.1 | |
| financial services analytical applications infrastructure | = 8.0.2= 8.0.3= 8.0.4= 8.0.5= 8.0.6= 8.0.7 | |
| jdeveloper | = 12.1.3.0.0= 12.2.1.3.0 | |
| primavera unifier | = 16.1= 16.2= 18.8≥ 17.1, ≤ 17.12 | |
| retail merchandising system | = 15.0= 16.0 | |
| webcenter portal | = 12.2.1.3.0 | |
| jboss enterprise application platform | = 7.2.0 | |
| openshift container platform | = 3.11 |
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free