FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/jav…

Overview

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

Affected

• jackson-databind >= 2.0.0, < 2.6.7.5
• jackson-databind >= 2.7.0, < 2.9.10.8
• debian_linux = 9.0
• service_level_manager
• agile_product_lifecycle_management = 9.3.6
• application_testing_suite = 13.3.0.1
• autovue = 21.0.2
• banking_corporate_lending_process_management = 14.2
• banking_corporate_lending_process_management = 14.3
• banking_corporate_lending_process_management = 14.5
• banking_credit_facilities_process_management = 14.2
• banking_credit_facilities_process_management = 14.3
• banking_credit_facilities_process_management = 14.5
• banking_extensibility_workbench = 14.2
• banking_extensibility_workbench = 14.3
• banking_extensibility_workbench = 14.5
• banking_supply_chain_finance = 14.2
• banking_supply_chain_finance = 14.3
• banking_supply_chain_finance = 14.5
• banking_treasury_management = 14.4
• banking_virtual_account_management = 14.2.0
• banking_virtual_account_management = 14.3.0
• banking_virtual_account_management = 14.5.0
• blockchain_platform <= 21.1.2
• commerce_platform >= 11.3.0, <= 11.3.2
• commerce_platform = 11.2.0
• communications_billing_and_revenue_management = 7.5.0.23.0
• communications_billing_and_revenue_management = 12.0.0.3.0
• communications_cloud_native_core_policy = 1.14.0
• communications_cloud_native_core_unified_data_repository = 1.4.0
• communications_convergent_charging_controller = 12.0.4.0.0
• communications_diameter_signaling_route >= 8.0.0.0, <= 8.5.0.0
• communications_element_manager >= 8.2.0.0, <= 8.2.4.0
• communications_evolved_communications_application_server = 7.1
• communications_network_charging_and_control = 12.0.4.0.0
• communications_policy_management = 12.5.0
• communications_services_gatekeeper = 7.0
• communications_session_report_manager >= 8.0.0.0, <= 8.2.2.1
• communications_session_route_manager >= 8.2.0.0, <= 8.2.2.1
• communications_unified_inventory_management = 7.4.1
• data_integrator = 12.2.1.4.0
• goldengate_application_adapters = 19.1.0.0.0
• insurance_policy_administration >= 11.1.0, <= 11.3.0
• insurance_policy_administration = 11.0.2
• insurance_rules_palette >= 11.1.0, <= 11.3.0
• insurance_rules_palette = 11.0.2
• jd_edwards_enterpriseone_orchestrator < 9.2.5.3
• jd_edwards_enterpriseone_tools < 9.2.5.3
• primavera_gateway >= 17.12.0, <= 17.12.11
• primavera_gateway >= 18.8.0, <= 18.8.11
• primavera_gateway >= 19.12.0, <= 19.12.10
• primavera_gateway = 20.12.0
• primavera_unifier >= 17.7, <= 17.12
• primavera_unifier >= 18.8, <= 19.12
• primavera_unifier = 20.12
• retail_customer_management_and_segmentation_foundation >= 16.0, <= 19.0
• retail_merchandising_system = 15.0.3
• retail_service_backbone = 14.1.3.2
• retail_service_backbone = 15.0.3.1
• retail_service_backbone = 16.0.3.0
• retail_xstore_point_of_service = 16.0.6
• retail_xstore_point_of_service = 17.0.4
• retail_xstore_point_of_service = 18.0.3
• retail_xstore_point_of_service = 19.0.2
• webcenter_portal = 12.2.1.3.0
• webcenter_portal = 12.2.1.4.0

Remediation

Upgrade past the affected range:

• jackson-databind 2.9.10.8
• jd_edwards_enterpriseone_orchestrator 9.2.5.3
• jd_edwards_enterpriseone_tools 9.2.5.3