A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
BF323F3D-B2A4-41E7-94F9-5539C9B7025E
2.8.11.5
2.8.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
FE5543DD-3F9D-45EF-8034-E1EF9657955A
2.9.10
2.9.0
OR
cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:*
5EC98B22-FFAA-4B59-8E63-EBAA4336AD13
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
E94F7F59-1785-493F-91A7-5F5EA5E87E4D
OR
cpe:2.3:a:oracle:goldengate_stream_analytics:*:*:*:*:*:*:*:*
F4E7F2AA-B851-4D85-9895-2CDD6BE9FCB4
19.1.0.0.1
OR
Another gadget (*) type report regarding a class of `xalan`.

Mitre id: not yet allocated
Reporter: @ybhou1993 (via #2462 originally)

* 2.9.10
* 2.8.11.5
* does not affect 2.10.0 and later

-----

(*) See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for more on general problem type

Block one more gadget type (xalan2)
This is a GitHub Issue
repo:jackson-databind
owner:FasterXML
Title : Block one more gadget type (xalan2)
Issue date:

--- start body ---
Another gadget (*) type report regarding a class of `xalan`.

Mitre id: not yet allocated
Reporter: @ybhou1993 (via #2462 originally)

* 2.9.10
* 2.8.11.5
* does not affect 2.10.0 and later

-----

(*) See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for more on general problem type

--- end body ---

comments :
--- start comments ---

--- end comments ---