| Package | Affected versions | Patched versions |
|---|---|---|
| com.fasterxml.jackson.core:jackson-databind | ≥ 2.7.0, < 2.7.9.5≥ 2.8.0, < 2.8.11.3≥ 2.9.0, < 2.9.8 | 2.7.9.52.8.11.32.9.8 |
| jackson-databind | ≥ 2.6.0, ≤ 2.6.7.2≥ 2.7.0, < 2.7.9.5≥ 2.8.0, < 2.8.11.3≥ 2.9.0, < 2.9.8 | 2.7.9.52.8.11.32.9.8 |
| business process management suite | = 12.1.3.0.0= 12.2.1.3.0 | |
| primavera p6 enterprise project portfolio management | = 15.1= 15.2= 16.1= 16.2= 18.8≥ 17.7, ≤ 17.12 | |
| primavera unifier | = 16.1= 16.2= 18.8≥ 17.7, ≤ 17.12 | |
| retail workforce management software | = 1.60.9.0.0 | |
| webcenter portal | = 12.2.1.3.0 | |
| automation manager | = 7.3.1 | |
| decision manager | = 7.3.1 | |
| jboss bpm suite | = 6.4.11 | |
| jboss brms | = 6.4.10 | |
| openshift container platform | = 3.11 |
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free