Description
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jackson-databind | 2.9.8-1 | — |
| Debian 13 | jackson-databind | 2.9.8-1 | — |
| Debian 12 | jackson-databind | 2.9.8-1 | — |
| Debian 9 | jackson-databind | 2.8.6-1+deb9u5 | DSA-4452-1 |
| Debian 8 | jackson-databind | 2.4.2-2+deb8u5 | DLA-1703-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | jackson-databind | 2.4.2-3ubuntu0.1~esm2 | USN-4813-1 |
| Ubuntu Pro 14.04 LTS | jackson-databind | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | rh-maven35-jackson-databind +1 | 2.7.6-2.5.el7 | RHSA-2019:0782 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +16 | 2.6.3-5.redhat_00020.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-apache-commons-lang | 3.8.0-1.redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.2.7-1.redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-artemis-native +1 | 2.6.3-15.redhat_00020.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-byte-buddy | 1.9.5-1.redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-cxf-xjc-dv +5 | 3.2.3-2.redhat_00002.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-dom4j | 2.1.1-2.redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-elytron-web +1 | 1.2.4-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.9-2.Final_redhat_00002.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-httpcomponents-asyncclient | 4.1.4-1.redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-infinispan +8 | 9.3.6-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.15-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jackson-core +5 | 2.9.8-2.redhat_00004.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jackson-modules-base +4 | 2.9.8-1.redhat_00004.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jberet +1 | 1.3.2-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.15-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jboss-el-api_3.0_spec | 1.0.13-2.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jboss-genericjms | 2.0.1-2.Final_redhat_00002.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jboss-logmanager | 2.1.7-3.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting-jmx | 3.0.1-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jboss-security-negotiation | 3.0.5-2.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +22 | 1.3.0-7.Final_redhat_00004.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-narayana +10 | 5.9.1-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-picketlink-api +9 | 2.5.5-16.SP12_redhat_4.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-resteasy +19 | 3.6.1-4.SP3_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-sun-istack-commons +2 | 3.0.7-2.redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.19-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-undertow-jastow | 2.0.7-2.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.2.1-6.GA_redhat_00004.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron | 1.6.2-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron-tool | 1.4.1-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.13-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.2.1-6.GA_redhat_00004.1.el7eap | RHSA-2019:1108 |
| Red Hat JBoss EAP 7 | eap7-wildfly-transaction-client | 1.1.3-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-yasson | 1.0.2-1.redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.fasterxml.jackson.core:jackson-databind | < 2.7.9.4 | 2.7.9.4 | GHSA-cjjf-94ff-43w7 |
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.8.0, < 2.8.11.2 | 2.8.11.2 | GHSA-cjjf-94ff-43w7 |
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.9.0, < 2.9.6 | 2.9.6 | GHSA-cjjf-94ff-43w7 |
Advisories 8
- USN-4813-1 jackson-databind vulnerabilities Ubuntu Security Notices (USN) · Oct 12, 2026
- RHSA-2019:1108 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.1 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:1107 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.1 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:0782 Red Hat Security Advisory: rh-maven35-jackson-databind security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DSA-4452-1 jackson-databind - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1703-1 jackson-databind - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2024-1682 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2024
References
- RHSA-2019:0782 vendor-advisory
- RHSA-2019:0877 vendor-advisory
- RHBA-2019:0959 vendor-advisory
- RHSA-2019:1107 vendor-advisory
- RHSA-2019:1108 vendor-advisory
- RHSA-2019:1106 vendor-advisory
- RHSA-2019:1140 vendor-advisory
- DSA-4452 vendor-advisory
- 20190527 [SECURITY] [DSA 4452-1] jackson-databind security update mailing-list
- RHSA-2019:1782 vendor-advisory
- RHSA-2019:1797 vendor-advisory
- 107585 vdb-entry
- RHSA-2019:1822 vendor-advisory
- RHSA-2019:1823 vendor-advisory
- RHSA-2019:2804 vendor-advisory
- RHSA-2019:2858 vendor-advisory
- [lucene-issues] 20191004 [GitHub] [lucene-solr] marungo opened a new pull request #925: SOLR-13818: Upgrade jackson to 2.10.0 mailing-list
- RHSA-2019:3002 vendor-advisory
- RHSA-2019:3140 vendor-advisory
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
- RHSA-2019:3149 vendor-advisory
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- RHSA-2019:3892 vendor-advisory
- RHSA-2019:4037 vendor-advisory
- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZEDLDUYBSTDY4GWDBUXGJNS2RFYTFVRC/
- https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf
- https://security.netapp.com/advisory/ntap-20190530-0003/
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1671098
- https://github.com/FasterXML/jackson-databind/issues/2052
- https://github.com/FasterXML/jackson-databind/commit/28badf7ef60ac3e7ef151cd8e8ec010b8479226a