FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).

Overview

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).

Affected

• jackson-databind >= 2.9.0, < 2.9.10.4
• debian_linux = 8.0
• steelstore_cloud_integrated_storage
• agile_product_lifecycle_management = 9.3.6
• autovue_for_agile_product_lifecycle_management = 21.0.2
• banking_digital_experience = 18.1
• banking_digital_experience = 18.2
• banking_digital_experience = 18.3
• banking_digital_experience = 19.1
• banking_digital_experience = 19.2
• banking_digital_experience = 20.1
• banking_platform >= 2.4.0, <= 2.9.0
• communications_calendar_server = 8.0.0.4.0
• communications_contacts_server = 8.0.0.4.0
• communications_contacts_server = 8.0.0.5.0
• communications_diameter_signaling_router >= 8.0.0, <= 8.2.2
• communications_element_manager >= 8.2.0, <= 8.2.2
• communications_evolved_communications_application_server = 7.1
• communications_instant_messaging_server = 10.0.1.4.0
• communications_network_charging_and_control >= 12.0.0, <= 12.0.3
• communications_network_charging_and_control = 6.0.1
• communications_session_report_manager >= 8.2.0, <= 8.2.2
• communications_session_route_manager >= 8.2.0, <= 8.2.2
• enterprise_manager_base_platform = 13.3.0.0
• enterprise_manager_base_platform = 13.4.0.0
• financial_services_analytical_applications_infrastructure >= 8.0.6, <= 8.1.0
• financial_services_institutional_performance_analytics = 8.0.6
• financial_services_institutional_performance_analytics = 8.0.7
• financial_services_institutional_performance_analytics = 8.1.0
• financial_services_price_creation_and_discovery = 8.0.6
• financial_services_price_creation_and_discovery = 8.0.7
• financial_services_retail_customer_analytics = 8.0.6
• global_lifecycle_management_opatch < 12.2.0.1.20
• insurance_policy_administration_j2ee = 11.0.2.25
• insurance_policy_administration_j2ee = 11.1.0.15
• jd_edwards_enterpriseone_orchestrator < 9.2.4.2
• jd_edwards_enterpriseone_tools < 9.2.4.2
• primavera_unifier >= 17.7, <= 17.12
• primavera_unifier = 16.1
• primavera_unifier = 16.2
• primavera_unifier = 18.8
• primavera_unifier = 19.12
• retail_merchandising_system = 15.0
• retail_sales_audit = 14.1
• retail_service_backbone = 14.1
• retail_service_backbone = 15.0
• retail_service_backbone = 16.0
• retail_xstore_point_of_service = 15.0
• retail_xstore_point_of_service = 16.0
• retail_xstore_point_of_service = 17.0
• retail_xstore_point_of_service = 18.0
• retail_xstore_point_of_service = 19.0
• weblogic_server = 12.2.1.3.0
• weblogic_server = 12.2.1.4.0

Remediation

Upgrade past the affected range:

• jackson-databind 2.9.10.4
• global_lifecycle_management_opatch 12.2.0.1.20
• jd_edwards_enterpriseone_orchestrator 9.2.4.2
• jd_edwards_enterpriseone_tools 9.2.4.2