תיאור (מקור, אנגלית)
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
מוצרים מושפעים
fasterxml: jackson-databind; netapp: active iq unified manager; debian: debian linux; oracle: autovue for agile product lifecycle management; oracle: banking platform; oracle: communications contacts server; oracle: communications evolved communications application server; oracle: communications instant messaging server; oracle: communications network charging and control; oracle: enterprise manager base platform; oracle: global lifecycle management opatch; oracle: jd edwards enterpriseone orchestrator; oracle: jd edwards enterpriseone tools; oracle: primavera unifier; oracle: retail xstore point of service
קישורים10
- github.com/FasterXML/jackson-databind/issues/2634 PatchThird Party Advisory
- www.oracle.com/security-alerts/cpujan2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuoct2020.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
- github.com/FasterXML/jackson-databind/issues/2634 PatchThird Party Advisory
- www.oracle.com/security-alerts/cpujan2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuoct2020.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
- lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036…
- lists.apache.org/thread.html/r4accb2e0de9679174efd3d113a059bab…
מדדים
- CVSS 3.1
-
9.8
CRITICAL
מקור הציון: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — סבירות ניצול
- 18% אחוזון 97 · נכון ל-6 בנובמבר 2026
- CWE
- CWE-502
האם אפשר לנצל את הפגיעות הזו אצלכם?
עדכון אבטחה סוגר את הפרצה הידועה. בדיקת חדירות מראה לאן תוקף עדיין יכול להגיע — עם הוכחה.