High · published July 30, 2019
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
| Product | Versions | Fixed in |
|---|---|---|
| fasterxml/jackson-databind | ≥ 2.0.0, < 2.6.7.3 | 2.6.7.3 |
| fasterxml/jackson-databind | ≥ 2.7.0, < 2.7.9.6 | 2.7.9.6 |
| fasterxml/jackson-databind | ≥ 2.8.0, < 2.8.11.4 | 2.8.11.4 |
| fasterxml/jackson-databind | ≥ 2.9.0, < 2.9.9.2 | 2.9.9.2 |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| apache/drill | all versions | — |
| redhat/jboss_middleware_text-only_advisories | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/communications_diameter_signaling_router | all versions | — |
| oracle/communications_diameter_signaling_router | all versions | — |
| oracle/communications_diameter_signaling_router | all versions | — |
| oracle/communications_diameter_signaling_router | all versions | — |
| oracle/communications_instant_messaging_server | all versions | — |
| oracle/financial_services_analytical_applications_infrastructure | ≥ 8.0.2, ≤ 8.0.8 | — |
| oracle/global_lifecycle_management_opatch | < 11.2.0.3.23 | 11.2.0.3.23 |
| oracle/global_lifecycle_management_opatch | ≥ 12.2.0.1.0, < 12.2.0.1.19 | 12.2.0.1.19 |
| oracle/global_lifecycle_management_opatch | ≥ 13.9.4.0.0, < 13.9.4.2.1 | 13.9.4.2.1 |
| oracle/global_lifecycle_management_opatch | all versions | — |
| oracle/global_lifecycle_management_opatch | all versions | — |
| oracle/goldengate_stream_analytics | < 19.1.0.0.1 | 19.1.0.0.1 |
| oracle/jd_edwards_enterpriseone_orchestrator | all versions | — |
| oracle/jd_edwards_enterpriseone_tools | all versions | — |
| oracle/primavera_gateway | ≥ 17.7, ≤ 17.12 | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_gateway | all versions | — |
| oracle/retail_customer_management_and_segmentation_foundation | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/siebel_engineering_-_installer_\&_deployment | ≤ 19.8 | — |
| oracle/siebel_ui_framework | ≤ 19.10 | — |