AI Score
Confidence
Low
EPSS
Percentile
66.0%
SSVC
Exploitation
none
Automatable
no
Technical Impact
total
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.
[
{
"cpes": [
"cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*"
],
"vendor": "fasterxml",
"product": "jackson-databind",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.9.10.8",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
],
"vendor": "debian",
"product": "debian_linux",
"versions": [
{
"status": "affected",
"version": "8.0"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*"
],
"vendor": "netapp",
"product": "steelstore_cloud_integrated_storage",
"versions": [
{
"status": "affected",
"version": "*"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "agile_plm",
"versions": [
{
"status": "affected",
"version": "9.3.6"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "autovue_for_agile_product_lifecycle_management",
"versions": [
{
"status": "affected",
"version": "21.0.2"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "banking_digital_experience",
"versions": [
{
"status": "affected",
"version": "18.1",
"versionType": "custom",
"lessThanOrEqual": "18.3"
},
{
"status": "affected",
"version": "19.1",
"versionType": "custom",
"lessThanOrEqual": "19.2"
},
{
"status": "affected",
"version": "20.1"
},
{
"status": "affected",
"version": "2.4.0",
"versionType": "custom",
"lessThanOrEqual": "2.9.0"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_calendar_server:8.0.0.4.0:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "communications_calendar_server",
"versions": [
{
"status": "affected",
"version": "8.0.0.4.0",
"versionType": "custom",
"lessThanOrEqual": "8.0.0.5.0"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_diameter_signaling_router:-:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "communications_diameter_signaling_router",
"versions": [
{
"status": "affected",
"version": "8.0.0",
"versionType": "custom",
"lessThanOrEqual": "8.2.2"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "communications_element_manager",
"versions": [
{
"status": "affected",
"version": "8.2.0",
"versionType": "custom",
"lessThanOrEqual": "8.2.2"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "communications_evolved_communications_application_server",
"versions": [
{
"status": "affected",
"version": "7.1"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.4.0:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "communications_instant_messaging_server",
"versions": [
{
"status": "affected",
"version": "10.0.1.4.0"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "communications_network_charging_and_control",
"versions": [
{
"status": "affected",
"version": "6.0.1"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_network_charging_and_control:12.0.0:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "communications_network_charging_and_control",
"versions": [
{
"status": "affected",
"version": "12.0.0",
"versionType": "custom",
"lessThanOrEqual": "12.0.3"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_session_route_manager:-:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "communications_session_route_manager",
"versions": [
{
"status": "affected",
"version": "8.2.0",
"versionType": "custom",
"lessThanOrEqual": "8.2.2"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "enterprise_manager_base_platform",
"versions": [
{
"status": "affected",
"version": "13.3.0.0",
"versionType": "custom",
"lessThanOrEqual": "13.4.0.0"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.6:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "financial_services_analytical_applications_infrastructure",
"versions": [
{
"status": "affected",
"version": "8.0.6",
"versionType": "custom",
"lessThanOrEqual": "8.1.0"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.6:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "financial_services_institutional_performance_analytics",
"versions": [
{
"status": "affected",
"version": "8.0.6"
},
{
"status": "affected",
"version": "8.0.7"
},
{
"status": "affected",
"version": "8.1.0"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.6:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "financial_services_price_creation_and_discovery",
"versions": [
{
"status": "affected",
"version": "8.0.6",
"versionType": "custom",
"lessThanOrEqual": "8.0.7"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:financial_services_retail_customer_analytics:8.0.6:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "financial_services_retail_customer_analytics",
"versions": [
{
"status": "affected",
"version": "8.0.6"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "global_lifecycle_management_opatch",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom",
"lessThanOrEqual": "12.2.0.1.20"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:insurance_policy_administration_j2ee:*:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "insurance_policy_administration_j2ee",
"versions": [
{
"status": "affected",
"version": "11.0.2.25",
"lessThan": "11.1.0.15",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:-:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "jd_edwards_enterpriseone_orchestrator",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom",
"lessThanOrEqual": "9.2.4.2"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "primavera_unifier",
"versions": [
{
"status": "affected",
"version": "16.1"
},
{
"status": "affected",
"version": "16.2"
},
{
"status": "affected",
"version": "17.7",
"versionType": "custom",
"lessThanOrEqual": "17.12"
},
{
"status": "affected",
"version": "18.8"
},
{
"status": "affected",
"version": "19.12"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:retail_merchandising_system:15.0:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "retail_merchandising_system",
"versions": [
{
"status": "affected",
"version": "15.0"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:retail_sales_audit:14.1:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "retail_sales_audit",
"versions": [
{
"status": "affected",
"version": "14.1"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:retail_service_backbone:*:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "retail_service_backbone",
"versions": [
{
"status": "affected",
"version": "14.1"
},
{
"status": "affected",
"version": "15.0"
},
{
"status": "affected",
"version": "16.0"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "retail_xstore_point_of_service",
"versions": [
{
"status": "affected",
"version": "15.0",
"versionType": "custom",
"lessThanOrEqual": "19.0"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:oracle:weblogic_server:*:*:*:*:*:*:*:*"
],
"vendor": "oracle",
"product": "weblogic_server",
"versions": [
{
"status": "affected",
"version": "12.2.1.3.0",
"versionType": "custom",
"lessThanOrEqual": "12.2.1.4.0"
}
],
"defaultStatus": "unknown"
}
]
cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
github.com/FasterXML/jackson-databind/issues/2998
lists.debian.org/debian-lts-announce/2021/04/msg00025.html
security.netapp.com/advisory/ntap-20210205-0005/
www.oracle.com//security-alerts/cpujul2021.html
www.oracle.com/security-alerts/cpuApr2021.html
www.oracle.com/security-alerts/cpuapr2022.html
www.oracle.com/security-alerts/cpujan2022.html
www.oracle.com/security-alerts/cpujul2022.html
www.oracle.com/security-alerts/cpuoct2021.html