Description
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jackson-databind | 2.10.0-1 | — |
| Debian 13 | jackson-databind | 2.10.0-1 | — |
| Debian 12 | jackson-databind | 2.10.0-1 | — |
| Debian 8 | jackson-databind | 2.4.2-2+deb8u10 | DLA-2030-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | jackson-databind | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | jackson-databind | 2.4.2-3ubuntu0.1~esm2 | USN-4813-1 |
| Ubuntu Pro 14.04 LTS | jackson-databind | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.2.11-1.redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.3.5-6.SP3_redhat_00004.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.0.19-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.14-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-hibernate-validator +1 | 6.0.18-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jackson-core +9 | 2.9.10-1.redhat_00003.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jackson-databind | 2.9.10.1-1.redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jackson-modules-base +1 | 2.9.10-2.redhat_00003.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jberet +1 | 1.3.5-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.27-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsf-api_2.3_spec | 2.3.5-3.SP2_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +23 | 1.3.1-7.Final_redhat_00007.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.7.6-3.SP2_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-netty +1 | 4.1.42-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-picketlink-bindings +1 | 2.5.5-21.SP12_redhat_00010.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.28-2.SP1_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-undertow-jastow | 2.0.8-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-weld-ejb +6 | 3.0.6-3.Final_redhat_00003.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.2.6-5.GA_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.18-2.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.2.6-5.GA_redhat_00001.1.el7eap | RHSA-2020:0160 |
| Red Hat JBoss EAP 7 | eap7-wildfly-transaction-client | 1.1.8-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.9.0, < 2.9.10 | 2.9.10 | GHSA-f3j5-rmmp-3fc5 |
| Maven | com.fasterxml.jackson.core:jackson-databind | < 2.8.11.5 | 2.8.11.5 | GHSA-f3j5-rmmp-3fc5 |
Advisories 7
- RHSA-2020:0160 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:0161 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:0159 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- USN-4813-1 jackson-databind vulnerabilities Ubuntu Security Notices (USN) · Oct 12, 2026
- DLA-2030-1 jackson-databind - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2024-2181 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 18, 2024
References
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- RHSA-2019:3200 vendor-advisory
- [debian-lts-announce] 20191210 [SECURITY] [DLA 2030-1] jackson-databind security update mailing-list
- [druid-commits] 20200115 [druid] branch 0.17.0 updated: Suppress CVE-2019-20330 for htrace-core-4.0.1 (#9189) (#9191) mailing-list
- RHSA-2020:0164 vendor-advisory
- RHSA-2020:0159 vendor-advisory
- RHSA-2020:0160 vendor-advisory
- RHSA-2020:0161 vendor-advisory
- RHSA-2020:0445 vendor-advisory
- [skywalking-dev] 20200324 [CVE-2019-17267] Upgrade jackson-databind version to 2.9.10 mailing-list
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://security.netapp.com/advisory/ntap-20191017-0006/
- https://github.com/FasterXML/jackson-databind/issues/2460
- https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.3...jackson-databind-2.9.10
- [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image mailing-list
- [geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12 mailing-list
- https://www.oracle.com/security-alerts/cpuoct2020.html