| Package | Affected versions | Patched versions |
|---|---|---|
| com.fasterxml.jackson.core:jackson-databind | ≥ 2.7.0, < 2.8.11.5≥ 2.9.0, < 2.9.10< 2.6.7.3 | 2.8.11.52.9.102.6.7.3 |
| geode | = 1.12.0 | |
| jackson-databind | ≥ 2.0.0, < 2.6.7.3≥ 2.7.0, < 2.8.11.5≥ 2.9.0, < 2.9.10 | 2.6.7.32.8.11.52.9.10 |
| decision manager | = 7.0 | |
| jboss data grid | = 7.0.0 | |
| jboss enterprise application platform | = 7.0 | |
| jboss fuse | = 7.0.0 | |
| openshift container platform | = 4.3 | |
| process automation | = 7.0 |
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5, and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free