| Package | Affected versions | Patched versions |
|---|---|---|
| com.fasterxml.jackson.core:jackson-databind | ≥ 2.0.0, < 2.6.7.3≥ 2.7.0, < 2.7.9.6≥ 2.8.0, < 2.8.11.4≥ 2.9.0, < 2.9.9.1 | 2.6.7.32.7.9.62.8.11.42.9.9.1 |
| jackson-databind | ≥ 2.0.0, < 2.6.7.3≥ 2.7.0, < 2.7.9.6≥ 2.8.0, < 2.8.11.4≥ 2.9.0, < 2.9.9.2 | 2.6.7.32.7.9.62.8.11.42.9.9.2 |
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free