| Package | Affected versions | Patched versions |
|---|---|---|
| com.fasterxml.jackson.core:jackson-databind | ≥ 2.7.0, < 2.7.9.5≥ 2.8.0, < 2.8.11.3≥ 2.9.0, < 2.9.8 | 2.7.9.52.8.11.32.9.8 |
| jackson-databind | ≥ 2.6.0, ≤ 2.6.7.2≥ 2.7.0, < 2.7.9.5≥ 2.8.0, < 2.8.11.3≥ 2.9.0, < 2.9.8 | 2.7.9.52.8.11.32.9.8 |
| business process management suite | = 12.1.3.0.0= 12.2.1.3.0 | |
| primavera p6 enterprise project portfolio management | = 15.1= 15.2= 16.1= 16.2= 18.8≥ 17.7, ≤ 17.12 | |
| primavera unifier | = 16.1= 16.2= 18.8≥ 17.7, ≤ 17.12 | |
| retail workforce management software | = 1.60.9.0.0 | |
| webcenter portal | = 12.2.1.3.0 | |
| automation manager | = 7.3.1 | |
| decision manager | = 7.3.1 | |
| jboss bpm suite | = 6.4.11 | |
| jboss brms | = 6.4.10 | |
| openshift container platform | = 3.11 |
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free