Description
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jackson-databind | 2.10.0-2 | — |
| Debian 13 | jackson-databind | 2.10.0-2 | — |
| Debian 12 | jackson-databind | 2.10.0-2 | — |
| Debian 10 | jackson-databind | 2.9.8-3+deb10u1 | DSA-4542-1 |
| Debian 9 | jackson-databind | 2.8.6-1+deb9u6 | DSA-4542-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | jackson-databind | 2.4.2-2+deb8u9 | DLA-1943-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | jackson-databind | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | jackson-databind | 2.4.2-3ubuntu0.1~esm2 | USN-4813-1 |
| Ubuntu Pro 14.04 LTS | jackson-databind | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | apache-commons-collections | 3.2.2-10.module+el8.1.0+3366+6dfb954c | RHSA-2020:1644 |
| RHEL 8 | apache-commons-lang | 2.6-21.module+el8.1.0+3366+6dfb954c | RHSA-2020:1644 |
| RHEL 8 | bea-stax +1 | 1.2.0-16.module+el8.1.0+3366+6dfb954c | RHSA-2020:1644 |
| RHEL 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.1.0+3366+6dfb954c | RHSA-2020:1644 |
| RHEL 8 | glassfish-jaxb +3 | 2.2.11-11.module+el8.1.0+3366+6dfb954c | RHSA-2020:1644 |
| RHEL 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.1.0+3366+6dfb954c | RHSA-2020:1644 |
| RHEL 8 | jackson-core +2 | 2.10.0-1.module+el8.2.0+5059+3eb3af25 | RHSA-2020:1644 |
| RHEL 8 | jackson-jaxrs-providers +1 | 2.9.9-1.module+el8.1.0+3832+9784644d | RHSA-2020:1644 |
| RHEL 8 | jackson-module-jaxb-annotations | 2.7.6-4.module+el8.1.0+3366+6dfb954c | RHSA-2020:1644 |
| RHEL 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.1.0+3366+6dfb954c | RHSA-2020:1644 |
| RHEL 8 | javassist +1 | 3.18.1-8.module+el8.1.0+3366+6dfb954c | RHSA-2020:1644 |
| RHEL 8 | jss +1 | 4.6.2-4.module+el8.2.0+6123+b4678599 | RHSA-2020:1644 |
| RHEL 8 | ldapjdk +1 | 4.21.0-2.module+el8.2.0+4573+c3c38c7b | RHSA-2020:1644 |
| RHEL 8 | pki-ca +8 | 10.8.3-1.module+el8.2.0+5925+bad5981a | RHSA-2020:1644 |
| RHEL 8 | pki-servlet-engine +1 | 1:9.0.7-16.module+el8.1.0+3366+6dfb954c | RHSA-2020:1644 |
| RHEL 8 | python-nss +2 | 1.0.1-10.module+el8.1.0+3366+6dfb954c | RHSA-2020:1644 |
| RHEL 8 | relaxngDatatype | 2011.1-7.module+el8.1.0+3366+6dfb954c | RHSA-2020:1644 |
| RHEL 8 | resteasy | 3.0.26-3.module+el8.1.0+3366+6dfb954c | RHSA-2020:1644 |
| RHEL 8 | slf4j +1 | 1.7.25-4.module+el8.1.0+3366+6dfb954c | RHSA-2020:1644 |
| RHEL 8 | stax-ex | 1.7.7-8.module+el8.1.0+3366+6dfb954c | RHSA-2020:1644 |
| RHEL 8 | tomcatjss | 7.4.1-2.module+el8.2.0+4573+c3c38c7b | RHSA-2020:1644 |
| RHEL 8 | velocity | 1.7-24.module+el8.1.0+3366+6dfb954c | RHSA-2020:1644 |
| RHEL 8 | xalan-j2 | 2.7.1-38.module+el8.1.0+3366+6dfb954c | RHSA-2020:1644 |
| RHEL 8 | xerces-j2 | 2.11.0-34.module+el8.1.0+3366+6dfb954c | RHSA-2020:1644 |
| RHEL 8 | xml-commons-apis | 1.4.01-25.module+el8.1.0+3366+6dfb954c | RHSA-2020:1644 |
| RHEL 8 | xml-commons-resolver | 1.2-26.module+el8.1.0+3366+6dfb954c | RHSA-2020:1644 |
| RHEL 8 | xmlstreambuffer | 1.5.4-8.module+el8.1.0+3366+6dfb954c | RHSA-2020:1644 |
| RHEL 8 | xsom | 0-19.20110809svn.module+el8.1.0+3366+6dfb954c | RHSA-2020:1644 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.2.11-1.redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.3.5-6.SP3_redhat_00004.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.0.19-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.14-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-hibernate-validator +1 | 6.0.18-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jackson-core +9 | 2.9.10-1.redhat_00003.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jackson-databind | 2.9.10.1-1.redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jackson-modules-base +1 | 2.9.10-2.redhat_00003.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jberet +1 | 1.3.5-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.27-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsf-api_2.3_spec | 2.3.5-3.SP2_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +23 | 1.3.1-7.Final_redhat_00007.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.7.6-3.SP2_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-netty +1 | 4.1.42-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-picketlink-bindings +1 | 2.5.5-21.SP12_redhat_00010.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.28-2.SP1_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-undertow-jastow | 2.0.8-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-weld-ejb +6 | 3.0.6-3.Final_redhat_00003.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.2.6-5.GA_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.18-2.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.2.6-5.GA_redhat_00001.1.el7eap | RHSA-2020:0160 |
| Red Hat JBoss EAP 7 | eap7-wildfly-transaction-client | 1.1.8-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | apache-commons-collections | 3.2.2-10.module_el8.5.0+2577+9e95fe00 | ALSA-2020:1644 |
| AlmaLinux 8 | apache-commons-lang | 2.6-21.module_el8.5.0+2577+9e95fe00 | ALSA-2020:1644 |
| AlmaLinux 8 | bea-stax-api | 1.2.0-16.module_el8.5.0+2577+9e95fe00 | ALSA-2020:1644 |
| AlmaLinux 8 | glassfish-fastinfoset | 1.2.13-9.module_el8.5.0+2577+9e95fe00 | ALSA-2020:1644 |
| AlmaLinux 8 | glassfish-jaxb-api | 2.2.12-8.module_el8.5.0+2577+9e95fe00 | ALSA-2020:1644 |
| AlmaLinux 8 | glassfish-jaxb-core +2 | 2.2.11-11.module_el8.5.0+2577+9e95fe00 | ALSA-2020:1644 |
| AlmaLinux 8 | jackson-core +2 | 2.10.0-1.module_el8.5.0+2577+9e95fe00 | ALSA-2020:1644 |
| AlmaLinux 8 | jackson-jaxrs-providers +1 | 2.9.9-1.module_el8.5.0+2577+9e95fe00 | ALSA-2020:1644 |
| AlmaLinux 8 | jackson-module-jaxb-annotations | 2.7.6-4.module_el8.5.0+2577+9e95fe00 | ALSA-2020:1644 |
| AlmaLinux 8 | jakarta-commons-httpclient | 1:3.1-28.module_el8.5.0+2577+9e95fe00 | ALSA-2020:1644 |
| AlmaLinux 8 | javassist +1 | 3.18.1-8.module_el8.5.0+2577+9e95fe00 | ALSA-2020:1644 |
| AlmaLinux 8 | python3-nss +1 | 1.0.1-10.module_el8.5.0+2577+9e95fe00.alma | ALSA-2020:1644 |
| AlmaLinux 8 | relaxngDatatype | 2011.1-7.module_el8.5.0+2577+9e95fe00 | ALSA-2020:1644 |
| AlmaLinux 8 | slf4j +1 | 1.7.25-4.module_el8.5.0+2577+9e95fe00 | ALSA-2020:1644 |
| AlmaLinux 8 | stax-ex | 1.7.7-8.module_el8.5.0+2577+9e95fe00 | ALSA-2020:1644 |
| AlmaLinux 8 | velocity | 1.7-24.module_el8.5.0+2577+9e95fe00 | ALSA-2020:1644 |
| AlmaLinux 8 | xalan-j2 | 2.7.1-38.module_el8.5.0+2577+9e95fe00 | ALSA-2020:1644 |
| AlmaLinux 8 | xerces-j2 | 2.11.0-34.module_el8.5.0+2577+9e95fe00 | ALSA-2020:1644 |
| AlmaLinux 8 | xml-commons-apis | 1.4.01-25.module_el8.5.0+2577+9e95fe00 | ALSA-2020:1644 |
| AlmaLinux 8 | xml-commons-resolver | 1.2-26.module_el8.5.0+2577+9e95fe00 | ALSA-2020:1644 |
| AlmaLinux 8 | xmlstreambuffer | 1.5.4-8.module_el8.5.0+2577+9e95fe00 | ALSA-2020:1644 |
| AlmaLinux 8 | xsom | 0-19.20110809svn.module_el8.5.0+2577+9e95fe00 | ALSA-2020:1644 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | apache-commons-collections | 3.2.2-10.module+el8.3.0+53+ea062990 | RLSA-2020:1644 |
| Rocky Linux 8 | apache-commons-lang | 2.6-21.module+el8.3.0+53+ea062990 | RLSA-2020:1644 |
| Rocky Linux 8 | bea-stax | 1.2.0-16.module+el8.3.0+53+ea062990 | RLSA-2020:1644 |
| Rocky Linux 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.3.0+53+ea062990 | RLSA-2020:1644 |
| Rocky Linux 8 | glassfish-jaxb | 2.2.11-11.module+el8.3.0+53+ea062990 | RLSA-2020:1644 |
| Rocky Linux 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.3.0+53+ea062990 | RLSA-2020:1644 |
| Rocky Linux 8 | jackson-core +2 | 2.10.0-1.module+el8.3.0+53+ea062990 | RLSA-2020:1644 |
| Rocky Linux 8 | jackson-jaxrs-providers | 2.9.9-1.module+el8.3.0+53+ea062990 | RLSA-2020:1644 |
| Rocky Linux 8 | jackson-module-jaxb-annotations | 2.7.6-4.module+el8.3.0+53+ea062990 | RLSA-2020:1644 |
| Rocky Linux 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.3.0+53+ea062990 | RLSA-2020:1644 |
| Rocky Linux 8 | javassist | 3.18.1-8.module+el8.3.0+53+ea062990 | RLSA-2020:1644 |
| Rocky Linux 8 | python-nss | 1.0.1-10.module+el8.3.0+53+ea062990 | RLSA-2020:1644 |
| Rocky Linux 8 | relaxngDatatype | 2011.1-7.module+el8.3.0+53+ea062990 | RLSA-2020:1644 |
| Rocky Linux 8 | resteasy | 3.0.26-3.module+el8.3.0+53+ea062990 | RLSA-2020:1644 |
| Rocky Linux 8 | slf4j | 1.7.25-4.module+el8.3.0+74+855e3f5d | RLSA-2020:1644 |
| Rocky Linux 8 | stax-ex | 1.7.7-8.module+el8.3.0+53+ea062990 | RLSA-2020:1644 |
| Rocky Linux 8 | velocity | 1.7-24.module+el8.3.0+53+ea062990 | RLSA-2020:1644 |
| Rocky Linux 8 | xalan-j2 | 2.7.1-38.module+el8.3.0+53+ea062990 | RLSA-2020:1644 |
| Rocky Linux 8 | xerces-j2 | 2.11.0-34.module+el8.3.0+53+ea062990 | RLSA-2020:1644 |
| Rocky Linux 8 | xml-commons-apis | 1.4.01-25.module+el8.3.0+53+ea062990 | RLSA-2020:1644 |
| Rocky Linux 8 | xml-commons-resolver | 1.2-26.module+el8.3.0+53+ea062990 | RLSA-2020:1644 |
| Rocky Linux 8 | xmlstreambuffer | 1.5.4-8.module+el8.3.0+53+ea062990 | RLSA-2020:1644 |
| Rocky Linux 8 | xsom | 0-19.20110809svn.module+el8.3.0+53+ea062990 | RLSA-2020:1644 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | apache-commons-collections | 3.2.2-10.module+el8.2.0+5508+146760da | ELSA-2020-1644 |
| Oracle Linux 8 | apache-commons-lang | 2.6-21.module+el8.2.0+5508+146760da | ELSA-2020-1644 |
| Oracle Linux 8 | bea-stax-api | 1.2.0-16.module+el8.2.0+5508+146760da | ELSA-2020-1644 |
| Oracle Linux 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.2.0+5508+146760da | ELSA-2020-1644 |
| Oracle Linux 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.2.0+5508+146760da | ELSA-2020-1644 |
| Oracle Linux 8 | glassfish-jaxb-core +2 | 2.2.11-11.module+el8.2.0+5508+146760da | ELSA-2020-1644 |
| Oracle Linux 8 | jackson-core +2 | 2.10.0-1.module+el8.2.0+5508+146760da | ELSA-2020-1644 |
| Oracle Linux 8 | jackson-jaxrs-providers +1 | 2.9.9-1.module+el8.2.0+5508+146760da | ELSA-2020-1644 |
| Oracle Linux 8 | jackson-module-jaxb-annotations | 2.7.6-4.module+el8.2.0+5508+146760da | ELSA-2020-1644 |
| Oracle Linux 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.2.0+5508+146760da | ELSA-2020-1644 |
| Oracle Linux 8 | javassist +1 | 3.18.1-8.module+el8.2.0+5508+146760da | ELSA-2020-1644 |
| Oracle Linux 8 | jss +1 | 4.6.2-4.module+el8.2.0+5594+09d37207 | ELSA-2020-1644 |
| Oracle Linux 8 | ldapjdk +1 | 4.21.0-2.module+el8.2.0+5594+09d37207 | ELSA-2020-1644 |
| Oracle Linux 8 | pki-ca +7 | 10.8.3-1.0.1.module+el8.2.0+5594+09d37207 | ELSA-2020-1644 |
| Oracle Linux 8 | pki-servlet-engine +1 | 1:9.0.7-16.module+el8.2.0+5508+146760da | ELSA-2020-1644 |
| Oracle Linux 8 | python3-nss +1 | 1.0.1-10.module+el8.2.0+5508+146760da | ELSA-2020-1644 |
| Oracle Linux 8 | relaxngDatatype | 2011.1-7.module+el8.2.0+5508+146760da | ELSA-2020-1644 |
| Oracle Linux 8 | resteasy | 3.0.26-3.module+el8.2.0+5508+146760da | ELSA-2020-1644 |
| Oracle Linux 8 | slf4j +1 | 1.7.25-4.module+el8.2.0+5508+146760da | ELSA-2020-1644 |
| Oracle Linux 8 | stax-ex | 1.7.7-8.module+el8.2.0+5508+146760da | ELSA-2020-1644 |
| Oracle Linux 8 | tomcatjss | 7.4.1-2.module+el8.2.0+5594+09d37207 | ELSA-2020-1644 |
| Oracle Linux 8 | velocity | 1.7-24.module+el8.2.0+5508+146760da | ELSA-2020-1644 |
| Oracle Linux 8 | xalan-j2 | 2.7.1-38.module+el8.2.0+5508+146760da | ELSA-2020-1644 |
| Oracle Linux 8 | xerces-j2 | 2.11.0-34.module+el8.2.0+5508+146760da | ELSA-2020-1644 |
| Oracle Linux 8 | xml-commons-apis | 1.4.01-25.module+el8.2.0+5508+146760da | ELSA-2020-1644 |
| Oracle Linux 8 | xml-commons-resolver | 1.2-26.module+el8.2.0+5508+146760da | ELSA-2020-1644 |
| Oracle Linux 8 | xmlstreambuffer | 1.5.4-8.module+el8.2.0+5508+146760da | ELSA-2020-1644 |
| Oracle Linux 8 | xsom | 0-19.20110809svn.module+el8.2.0+5508+146760da | ELSA-2020-1644 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.9.0, < 2.9.10.1 | 2.9.10.1 | GHSA-fmmc-742q-jg75 |
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.7.0, < 2.8.11.5 | 2.8.11.5 | GHSA-fmmc-742q-jg75 |
| Maven | com.fasterxml.jackson.core:jackson-databind | < 2.6.7.3 | 2.6.7.3 | GHSA-fmmc-742q-jg75 |
Advisories 12
- ALSA-2020:1644 Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2020:0160 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:0161 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:0159 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- USN-4813-1 jackson-databind vulnerabilities Ubuntu Security Notices (USN) · Oct 12, 2026
- RHSA-2020:1644 Red Hat Security Advisory: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- DSA-4542-1 jackson-databind - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1943-1 jackson-databind - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2020:1644 Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2024-2181 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 18, 2024
- ELSA-2020-1644 Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 5, 2020
References
- [debian-lts-announce] 20191002 [SECURITY] [DLA 1943-1] jackson-databind security update mailing-list
- DSA-4542 vendor-advisory
- 20191007 [SECURITY] [DSA 4542-1] jackson-databind security update mailing-list
- FEDORA-2019-b171554877 vendor-advisory
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- FEDORA-2019-cf87377f5f vendor-advisory
- [iceberg-issues] 20191027 [GitHub] [incubator-iceberg] rdsr commented on issue #535: Update Jackson to 2.9.10 for CVE-2019-14379 mailing-list
- [iceberg-commits] 20191028 [incubator-iceberg] branch master updated: Update Jackson to 2.10.0 for CVE-2019-16943 (#583) mailing-list
- [druid-commits] 20200115 [druid] branch 0.17.0 updated: Suppress CVE-2019-20330 for htrace-core-4.0.1 (#9189) (#9191) mailing-list
- RHSA-2020:0164 vendor-advisory
- RHSA-2020:0159 vendor-advisory
- RHSA-2020:0160 vendor-advisory
- RHSA-2020:0161 vendor-advisory
- RHSA-2020:0445 vendor-advisory
- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://github.com/FasterXML/jackson-databind/issues/2478
- https://security.netapp.com/advisory/ntap-20191017-0006/
- [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image mailing-list
- [geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12 mailing-list
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com//security-alerts/cpujul2021.html