תיאור (מקור, אנגלית)
A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
מוצרים מושפעים
fasterxml: jackson-databind; netapp: active iq unified manager; netapp: oncommand api services; netapp: oncommand insight; netapp: service level manager; apache: nifi; debian: debian linux; oracle: commerce experience manager; oracle: commerce guided search
קישורים10
- bugzilla.redhat.com/show_bug.cgi?id=1916633 Issue TrackingPatchThird Party Advisory
- github.com/FasterXML/jackson-databind/issues/2854 PatchThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=1916633 Issue TrackingPatchThird Party Advisory
- github.com/FasterXML/jackson-databind/issues/2854 PatchThird Party Advisory
- lists.apache.org/thread.html/r380e9257bacb8551ee6fcf2c59890ae9… Mailing ListThird Party Advisory
- lists.debian.org/debian-lts-announce/2021/04/msg00025.html Mailing ListThird Party Advisory
- security.netapp.com/advisory/ntap-20210219-0008/ Third Party Advisory
- www.oracle.com//security-alerts/cpujul2021.html Third Party Advisory
- lists.apache.org/thread.html/r380e9257bacb8551ee6fcf2c59890ae9… Mailing ListThird Party Advisory
- lists.debian.org/debian-lts-announce/2021/04/msg00025.html Mailing ListThird Party Advisory
מדדים
- CVSS 3.1
-
8.1
HIGH
מקור הציון: NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — סבירות ניצול
- 8% אחוזון 95 · נכון ל-11 בנובמבר 2026
- CWE
- CWE-502
האם אפשר לנצל את הפגיעות הזו אצלכם?
עדכון אבטחה סוגר את הפרצה הידועה. בדיקת חדירות מראה לאן תוקף עדיין יכול להגיע — עם הוכחה.