| Package | Affected versions | Patched versions |
|---|---|---|
| com.fasterxml.jackson.core:jackson-databind | ≥ 2.7.0, < 2.7.9.5≥ 2.8.0, < 2.8.11.3≥ 2.9.0, < 2.9.7 | 2.7.9.52.8.11.32.9.7 |
| jackson-databind | = 2.7.0= 2.8.0= 2.9.0≥ 2.6.0, < 2.6.7.2≥ 2.7.0, < 2.7.9.5≥ 2.8.0, < 2.8.11.3≥ 2.9.0, < 2.9.7 | 2.6.7.22.7.9.52.8.11.32.9.7 |
| banking platform | = 2.5.0= 2.6.0= 2.6.1= 2.6.2 | |
| communications billing and revenue management | = 12.0= 7.5 | |
| enterprise manager for virtualization | = 13.2.2= 13.2.3= 13.3.1 | |
| financial services analytical applications infrastructure | = 8.0.2= 8.0.3= 8.0.4= 8.0.5= 8.0.6= 8.0.7 | |
| jdeveloper | = 12.1.3.0.0= 12.2.1.3.0 | |
| primavera unifier | = 16.1= 16.2= 18.8≥ 17.1, ≤ 17.12 | |
| retail merchandising system | = 15.0= 16.0 | |
| webcenter portal | = 12.2.1.3.0 | |
| jboss enterprise application platform | = 7.2.0 | |
| openshift container platform | = 3.11 |
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free