Deserialization of Untrusted Data in jackson-databind - CVE-2022-42003

Vulnerability identifier: #VU68635

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-42003

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insecure input validation when processing serialized data when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. A remote attacker can pass specially crafted data to the application and cause a denial of service condition on the target system.

jackson-databind
Debian Linux
Gentoo Linux
Oracle Solaris Cluster
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Enterprise Storage
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Development Tools
openSUSE Leap
openEuler
Fedora
CICS Transaction Gateway
Migration Toolkit for Runtimes
IBM Watson Assistant for IBM Cloud Pak for Data
Oracle Banking Deposits and Lines of Credit Servicing
Oracle Banking Party Management
Oracle Banking Enterprise Default Management
Oracle Banking Loans Servicing
Jira Service Management Server
Jira Service Management Data Center
Crowd Data Center
Dell Secure Connect Gateway
OpenShift Logging
IBM Spectrum Control
IBM Sterling B2B Integrator
Oracle Communications Unified Inventory Management
Jira Software Data Center
Oracle Financial Services Behavior Detection Platform
Oracle Financial Services Enterprise Case Management
Oracle Communications Diameter Intelligence Hub
Oracle Communications Session Report Manager
Oracle Health Sciences Empirica Signal
Oracle SD-WAN Edge
Oracle Identity Manager Connector
Enterprise Manager Base Platform
Oracle Banking Trade Finance
Oracle Banking Treasury Management
Oracle Communications Cloud Native Core Network Data Analytics Function
Management Cloud Engine
Oracle Communications Cloud Native Core Network Exposure Function
Oracle Communications Cloud Native Core Network Repository Function
Splunk AppDynamics Database Agent
IBM Operations Analytics Predictive Insights
Sterling Connect Direct File Agent
Netcool Operations Insight
IBM Process Mining
IBM Cloud Pak for Multicloud Management Monitoring
IBM Fusion HCI
Red Hat build of Quarkus
Red Hat Integration Camel Extensions for Quarkus
Financial Transaction Manager for ACH Services and Check Services
IBM Cloud Transformation Advisor
QRadar User Behavior Analytics
IBM Sterling Connect:Direct for UNIX
Unified Mediation Bus
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Sterling Connect:Direct Web Services
IBM Sterling Partner Engagement Manager
Red Hat Satellite
IBM Maximo Asset Management
IBM Cloud Application Performance Management (APM)
Maximo Manage Application in IBM Maximo Application Suite
IBM Maximo Application Suite
IBM Common Licensing
IBM MQ
IBM Security Verify Governance
EMC Data Protection Advisor
NetWorker
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
Oracle Graph Server and Client
IBM Tivoli Netcool/OMNIbus Integration – Transport Module Common Integration Library
Operations Dashboard
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
IBM Watson Machine Learning Accelerator
Oracle Banking Platform
Guardium Data Security Center (GDSC)
Cloudera Observability with IBM
Security QRadar EDR
Oracle Utilities Framework
Oracle Business Intelligence Enterprise Edition
IBM Business Automation Manager Open Editions
Oracle Financial Services Analytical Applications Infrastructure
Datacap
IBM Engineering Requirements Management DOORS Next
IBM Security Verify Information Queue
Oracle Communications Policy Management
Oracle Application Testing Suite
Oracle FLEXCUBE Universal Banking
Oracle Retail Service Backbone
Oracle FLEXCUBE Investor Servicing
Oracle Retail Xstore Point of Service
Oracle Banking Digital Experience
Integration Designer
Oracle Siebel CRM
Db2 Graph
DataPower Operations Dashboard
IBM i Modernization Engine for Lifecycle Integration
Dell EMC Streaming Data Platform
IBM Planning Analytics Workspace
Answer Retrieval for Watson Discovery On Prem
Netezza Performance Server Replication Services
Tivoli Netcool/OMNIbus Integration - Probe for Microsoft Exchange Web Services
PowerStore T
PowerStore X
IBM Cloud Pak for Watson AIOps
Watson CP4D Data Stores
IBM Sterling Connect:Direct for Microsoft Windows
User Entity Behavior Analytics
IBM Engineering Lifecycle Optimization - Publishing
Engineering Lifecycle Management - Jazz Foundation
MobileFirst Platform
Storage Protect Server
Storage Virtualize
OpenPages for IBM Cloud Pak for Data
webMethods Integration Server
webMethods BPM
Dell Data Protection Central
Robotic Process Automation for Cloud Pak
IBM Data Risk Manager
Oracle Financial Services Crime and Compliance Management Studio
Oracle Communications Element Manager
Oracle Business Process Management Suite
Oracle Global Lifecycle Management NextGen OUI Framework
Oracle Banking Extensibility Workbench
Oracle Banking Trade Finance Process Management
Oracle Banking Liquidity Management
Oracle Banking Corporate Lending Process Management
Oracle Banking Virtual Account Management
Oracle Banking Supply Chain Finance
Oracle Banking Cash Management
Oracle Banking Credit Facilities Process Management
Stream Analytics
IBM Cloud Pak System
IBM App Connect for Manufacturing
JD Edwards EnterpriseOne Tools
Enterprise Manager for Virtualization
Primavera Unifier
Oracle Autovue for Agile Product Lifecycle Management
IBM Disconnected Log Collector
IBM Spectrum Protect Backup-Archive Client
Oracle Healthcare Translational Research
Oracle Communications Pricing Design Center
Oracle WebCenter Portal
Oracle Retail Sales Audit
Siebel CRM Deployment
Crowd Server
Red Hat Single Sign-On
Communications Unified Assurance
Oracle Communications Calendar Server
Oracle Communications Contacts Server
Oracle Communications Instant Messaging Server
Oracle Communications Billing and Revenue Management
Voice Gateway
IBM Sterling Global Mailbox (GM)
JBoss Enterprise Application Platform
AMQ Broker
Oracle Coherence
Primavera Gateway
AMQ Streams
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
Oracle Banking Corporate Lending
Jira Software Server
JBoss Data Grid
Jazz Reporting Service
IBM Qradar SIEM
IBM Cognos Command Center
Splunk Enterprise
PeopleSoft Enterprise PeopleTools
Oracle Documaker
Operational Decision Manager
IBM Cognos Analytics
Oracle Agile PLM Framework
IBM App Connect Enterprise
Red Hat Camel for Spring Boot
Oracle SQL Developer
Oracle Commerce Platform
Oracle Commerce Guided Search
Oracle Retail Merchandising System
Oracle Retail Customer Management and Segmentation Foundation
Identity Manager
Oracle GoldenGate
Oracle NoSQL Database
Oracle Database Server
IBM InfoSphere Information Server
Oracle Communications Cloud Native Core Unified Data Repository
Oracle Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Service Communication Proxy
Oracle Communications Cloud Native Core Network Slice Selection Function
Oracle Communications Cloud Native Core Security Edge Protection Proxy
IBM Spectrum Protect for Space Management
Cloud Foundry UAA
eap7-jboss-jsp (Red Hat package)
eap7-jboss-jsf (Red Hat package)
eap7-javaee-security-soteria (Red Hat package)
eap7-jettison (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-velocity (Red Hat package)
eap7-elytron-web (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-snakeyaml (Red Hat package)
QuMagie Mobile
eap7-undertow (Red Hat package)
eap7-jackson-databind (Red Hat package)
eap7-apache-sshd (Red Hat package)
jackson-databind
jackson-databind-javadoc
eap7-jackson-core (Red Hat package)
eap7-jackson-modules-java8 (Red Hat package)
eap7-jackson-annotations (Red Hat package)
eap7-jackson-jaxrs-providers (Red Hat package)
eap7-jackson-modules-base (Red Hat package)
jackson-databind (Debian package)
dev-java/jackson-databind
jackson-parent
jackson-bom
jackson-modules-base
jackson-core
jackson-jaxrs-providers
jackson-annotations
jenkins (Red Hat package)
eap7-resteasy (Red Hat package)
eap7-apache-cxf (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
eap7-netty (Red Hat package)
jenkins-2-plugins (Red Hat package)
eap7-jboss-remoting (Red Hat package)
eap7-hibernate-search (Red Hat package)
eap7-woodstox-core (Red Hat package)
eap7-wildfly (Red Hat package)
rh-sso7-keycloak (Red Hat package)
fasterxml-oss-parent
watsonx.data
Red Hat build of Eclipse Vert.x
IBM FileNet Content Manager
IBM Spectrum Protect for Virtual Environments: Data Protection for VMware
IBM Spectrum Protect for Virtual Environments: Data Protection for Hyper-V
Content Manager Enterprise Edition
Wildfly

Install updates from vendor's website.

jackson-databind - addressed in versions 2.12.7.1, 2.13.4.2, 2.14.0 rc1
Migration Toolkit for Runtimes - update to 1.0.1
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.5.3
IBM Data Risk Manager - update to 2.0.6.15
IBM Cloud Pak System - update to 2.3.3.6
IBM App Connect for Manufacturing - update to 3.0.1.2
Guardium Data Security Center (GDSC) - update to 3.6.1
Cloudera Observability with IBM - update to 3.6.2
Security QRadar EDR - update to 3.12.15
Jira Service Management Server - addressed in versions 4.20.27, 5.4.11
Jira Service Management Data Center - addressed in versions 4.20.27, 5.4.11
Crowd Data Center - addressed in versions 5.0.11, 5.1.9, 5.2.4
Crowd Server - addressed in versions 5.0.11, 5.1.9, 5.2.4
Dell Secure Connect Gateway - update to 5.14.00.10
OpenShift Logging - addressed in versions 5.3.14, 5.4.8, 5.5.5, 5.6.0
IBM Spectrum Control - update to 5.4.9
IBM Sterling Global Mailbox (GM) - addressed in versions 6.0.3.8, 6.1.2.1
IBM Sterling B2B Integrator - addressed in versions 6.0.3.9, 6.1.0.8, 6.1.1.4, 6.1.2.3, 6.2.0.0
JBoss Enterprise Application Platform - addressed in versions 7.1.9, 7.3.12, 7.4.9
Red Hat Single Sign-On - update to 7.6.2
AMQ Broker - update to 7.10.2
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.13.3
IBM Business Automation Manager Open Editions - update to 8.0.3
Jira Software Data Center - addressed in versions 8.20.28, 9.4.12, 9.11.3
Jira Software Server - addressed in versions 8.20.28, 9.4.12, 9.11.3
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
JBoss Data Grid - update to 8.4.1
Datacap - update to 9.1.10
JD Edwards EnterpriseOne Tools - update to 9.2.7.3
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.8
IBM Security Verify Information Queue - update to 10.0.5
Oracle Global Lifecycle Management NextGen OUI Framework - update to 13.9.4.2.11
Oracle FLEXCUBE Universal Banking - update to 14.7.0.0.0
Oracle Banking Trade Finance - update to 14.4
Oracle Banking Corporate Lending - update to 14.4
Oracle GoldenGate - addressed in versions 19.1.0.0.230418, 21.10.0.0.0
Stream Analytics - update to 19.1.0.0.8
Oracle NoSQL Database - update to 19.5.32
Oracle Siebel CRM - addressed in versions 23.3, 23.6
Siebel CRM Deployment - update to 24.5
Splunk AppDynamics Database Agent - update to 26.1.0
Cloud Foundry UAA - update to 76.2.0
eap7-jboss-jsp (Red Hat package) - addressed in versions api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el7eap, api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el8eap, api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el9eap
eap7-jboss-jsf (Red Hat package) - addressed in versions api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el7eap, api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el8eap, api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el9eap
Db2 Graph - addressed in versions 1.0.0.1562-amd64, 1.0.0.1562-s390x, 1.0.0.1562-ppcle, 1.0.0.1598-amd64, 1.0.0.1598-s390x, 1.0.0.1598-ppcle
eap7-javaee-security-soteria (Red Hat package) - addressed in versions 1.0.1-3.redhat_00003.1.el7eap, 1.0.1-3.redhat_00003.1.el8eap, 1.0.1-3.redhat_00003.1.el9eap
Voice Gateway - addressed in versions 1.0.8.2, 1.0.8.6
DataPower Operations Dashboard - update to 1.0.19.0
IBM Operations Analytics Predictive Insights - update to 1.3.6.6
eap7-jettison (Red Hat package) - addressed in versions 1.3.8-2.redhat_00002.1.ep7.el7, 1.5.2-1.redhat_00002.1.el7eap, 1.5.2-1.redhat_00002.1.el8eap, 1.5.2-1.redhat_00002.1.el9eap, 1.5.2-2.redhat_00002.1.el7eap
IBM i Modernization Engine for Lifecycle Integration - update to 1.4
Sterling Connect Direct File Agent - update to 1.4.0.2 iFix030
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.10-1.Final_redhat_00001.1.el7eap, 1.5.10-1.Final_redhat_00001.1.el8eap, 1.5.10-1.Final_redhat_00001.1.el9eap
Netcool Operations Insight - update to 1.6.9
Dell EMC Streaming Data Platform - update to 1.7.0
eap7-velocity (Red Hat package) - update to 1.7.0-3.redhat_00006.1.ep7.el7
IBM Disconnected Log Collector - update to 1.8.3
eap7-elytron-web (Red Hat package) - addressed in versions 1.9.3-1.Final_redhat_00001.1.el7eap, 1.9.3-1.Final_redhat_00001.1.el8eap, 1.9.3-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-24.Final_redhat_00023.1.el7eap, 1.10.0-24.Final_redhat_00023.1.el8eap, 1.10.0-24.Final_redhat_00023.1.el9eap
IBM Process Mining - update to 1.13.2
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.16-1.Final_redhat_00001.1.el7eap, 1.15.16-1.Final_redhat_00001.1.el8eap, 1.15.16-1.Final_redhat_00001.1.el9eap
eap7-snakeyaml (Red Hat package) - addressed in versions 1.33.0-1.SP1_redhat_00001.1.el7eap, 1.33.0-1.SP1_redhat_00001.1.ep7.el7
watsonx.data - update to 2.0.3
IBM Planning Analytics Workspace - update to 2.0.83
QuMagie Mobile - update to 2.2.0.0126
eap7-undertow (Red Hat package) - addressed in versions 2.2.22-1.SP3_redhat_00001.1.el7eap, 2.2.22-1.SP3_redhat_00001.1.el8eap, 2.2.22-1.SP3_redhat_00001.1.el9eap
AMQ Streams - addressed in versions 2.3.0, 2.4.0
IBM Cloud Pak for Multicloud Management Monitoring - update to 2.3 Fix Pack 6
IBM Fusion HCI - update to 2.7.1
Red Hat build of Quarkus - update to 2.7.7
eap7-jackson-databind (Red Hat package) - addressed in versions 2.8.11.6-2.SP1_redhat_00002.1.ep7.el7, 2.10.4-4.redhat_00004.1.el7eap, 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
Answer Retrieval for Watson Discovery On Prem - update to 2.9.0
eap7-apache-sshd (Red Hat package) - addressed in versions 2.9.2-1.redhat_00001.1.el7eap, 2.9.2-1.redhat_00001.1.el8eap, 2.9.2-1.redhat_00001.1.el9eap
jackson-databind - update to 2.9.8-10
jackson-databind-javadoc - update to 2.9.8-10
eap7-jackson-core (Red Hat package) - addressed in versions 2.10.4-2.redhat_00004.1.el7eap, 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-modules-java8 (Red Hat package) - addressed in versions 2.10.4-2.redhat_00004.1.el7eap, 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-annotations (Red Hat package) - addressed in versions 2.10.4-2.redhat_00004.1.el7eap, 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-jaxrs-providers (Red Hat package) - addressed in versions 2.10.4-2.redhat_00004.1.el7eap, 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-modules-base (Red Hat package) - addressed in versions 2.10.4-4.redhat_00004.1.el7eap, 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
jackson-databind (Debian package) - update to 2.12.1-1+deb11u1
Red Hat Integration Camel Extensions for Quarkus - update to 2.13.2
dev-java/jackson-databind - update to 2.13.4.1
jackson-databind - update to 2.13.4.2-150200.3.12.1
jackson-databind-javadoc - update to 2.13.4.2-150200.3.12.1
jackson-parent - update to 2.14-1.fc38
jackson-bom - update to 2.14.1-1.fc38
jackson-modules-base - update to 2.14.1-1.fc38
jackson-core - update to 2.14.1-1.fc38
jackson-databind - update to 2.14.1-1.fc38
jackson-jaxrs-providers - update to 2.14.1-1.fc38
jackson-annotations - update to 2.14.1-3.fc38
jenkins (Red Hat package) - addressed in versions 2.361.4.1675702346-3.el8, 2.401.1.1686831596-3.el8
Netezza Performance Server Replication Services - update to 3.0.5.0
Financial Transaction Manager for ACH Services and Check Services - update to 3.0.5.4 iFix 28
eap7-resteasy (Red Hat package) - addressed in versions 3.0.27-1.Final_redhat_00001.1.ep7.el7, 3.11.6-1.Final_redhat_00001.1.el7eap
eap7-apache-cxf (Red Hat package) - update to 3.1.16-4.redhat_00003.1.ep7.el7
Tivoli Netcool/OMNIbus Integration - Probe for Microsoft Exchange Web Services - update to 3.2
PowerStore T - update to 3.2.1.0-1989710
PowerStore X - update to 3.2.1.0-1989710
eap7-hal-console (Red Hat package) - addressed in versions 3.2.17-1.Final_redhat_00001.1.el7eap, 3.3.16-1.Final_redhat_00001.1.el7eap, 3.3.16-1.Final_redhat_00001.1.el8eap, 3.3.16-1.Final_redhat_00001.1.el9eap
IBM Cloud Transformation Advisor - update to 3.3.1
Red Hat Camel for Spring Boot - addressed in versions 3.18.3 Patch 2, 3.20.1
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.49-1.Final_redhat_00001.1.el7eap, 4.0.49-1.Final_redhat_00001.1.el8eap, 4.0.49-1.Final_redhat_00001.1.el9eap
IBM Cloud Pak for Watson AIOps - update to 4.1
QRadar User Behavior Analytics - update to 4.1.12
eap7-netty (Red Hat package) - addressed in versions 4.1.63-1.Final_redhat_00002.1.ep7.el7, 4.1.63-4.Final_redhat_00002.1.el7eap
IBM Sterling Connect:Direct for UNIX - addressed in versions 4.3.0.1.107, 6.0.0.2.143, 6.1.0.4.73, 6.2.0.5.11
Red Hat build of Eclipse Vert.x - update to 4.3.4
Unified Mediation Bus - update to 4.4
Watson CP4D Data Stores - update to 4.6.3
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.6.5
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.0
IBM Sterling Connect:Direct for Microsoft Windows - addressed in versions 4.8.0.3.52, 6.0.0.4.60, 6.1.0.2.54, 6.2.0.4.20
jenkins-2-plugins (Red Hat package) - addressed in versions 4.11.1686831822-1.el8, 4.12.1675702407-1.el8
User Entity Behavior Analytics - update to 5.0.2
App Connect Enterprise Certified Container - addressed in versions 5.0.3, 7.1.0
eap7-jboss-remoting (Red Hat package) - addressed in versions 5.0.27-1.Final_redhat_00001.1.el7eap, 5.0.27-1.Final_redhat_00001.1.el8eap, 5.0.27-1.Final_redhat_00001.1.el9eap
IBM FileNet Content Manager - addressed in versions 5.5.4.0 IF009, 5.5.8.0 IF003, 5.5.9.0 IF001
eap7-hibernate-search (Red Hat package) - addressed in versions 5.10.13-3.Final_redhat_00001.1.el7eap, 5.10.13-3.Final_redhat_00001.1.el8eap, 5.10.13-3.Final_redhat_00001.1.el9eap
IBM Sterling Connect:Direct Web Services - addressed in versions 6.0.0.12, 6.1.0.16, 6.2.0.12
IBM Sterling Partner Engagement Manager - addressed in versions 6.1.2.8, 6.2.0.6, 6.2.1.3, 6.2.2.1
eap7-woodstox-core (Red Hat package) - addressed in versions 6.4.0-1.redhat_00001.1.el7eap, 6.4.0-1.redhat_00001.1.el8eap, 6.4.0-1.redhat_00001.1.el9eap
Red Hat Satellite - update to 6.13
IBM Engineering Lifecycle Optimization - Publishing - addressed in versions 7.0.1.23, 7.0.2.25
Jazz Reporting Service - update to 7.0.2 iFix022
Engineering Lifecycle Management - Jazz Foundation - addressed in versions 7.0.3 iFix020, 7.1.0 iFix006
eap7-wildfly (Red Hat package) - addressed in versions 7.1.9-2.GA_redhat_00002.1.ep7.el7, 7.3.12-3.GA_redhat_00002.1.el7eap, 7.4.9-4.GA_redhat_00003.1.el7eap, 7.4.9-4.GA_redhat_00003.1.el8eap, 7.4.9-4.GA_redhat_00003.1.el9eap
IBM Qradar SIEM - update to 7.5.0 Update Pack 6
IBM Maximo Asset Management - addressed in versions 7.6.1.2.32, 7.6.1.3.7
MobileFirst Platform - update to 8.0.0.0-MFPF-IF202304111626
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
IBM Spectrum Protect for Space Management - update to 8.1.17.0
IBM Spectrum Protect for Virtual Environments: Data Protection for VMware - update to 8.1.17.0
IBM Spectrum Protect for Virtual Environments: Data Protection for Hyper-V - update to 8.1.17.0
IBM Spectrum Protect Backup-Archive Client - update to 8.1.17.0
Storage Protect Server - update to 8.1.19
Maximo Manage Application in IBM Maximo Application Suite - update to 8.4.8
Storage Virtualize - addressed in versions 8.6.3.0, 8.7.0.0
Content Manager Enterprise Edition - update to 8.7.0.1
IBM Maximo Application Suite - addressed in versions 8.8.6, 8.9.2
Operational Decision Manager - addressed in versions 8.10.5.2 Interim fix 1, 8.11.0.1 Interim fix 30, 8.11.1 Interim fix 24, 8.12.0.1 Interim fix 5
OpenPages for IBM Cloud Pak for Data - update to 8.302.0
IBM Common Licensing - update to 9.0.0.6
IBM MQ - addressed in versions 9.3.0.2, 9.3.1.1
IBM Security Verify Governance - update to 10.0.1.0.4
IBM Cognos Command Center - update to 10.2.4 Fix Pack 1 IF17
webMethods Integration Server - update to 11.1 Fix 1
webMethods BPM - update to 11.1 Fix 1
IBM Cognos Analytics - addressed in versions 11.1.7.6, 11.2.4
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.6-1.redhat_00001.1.el7sso, 18.0.6-1.redhat_00001.1.el8sso, 18.0.6-1.redhat_00001.1.el9sso
EMC Data Protection Advisor - update to 19.10 B46
NetWorker - update to 19.10.0.0
Dell Data Protection Central - update to 19.11.0-2
IBM Business Automation Workflow - addressed in versions 20.0.0.2, 21.0.3, 21.0.3 IF015, 22.0.1, 22.0.1 IF005
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.18, 22.0.2.2
Robotic Process Automation for Cloud Pak - update to 21.0.7
Oracle Graph Server and Client - update to 23.1.0
Oracle SQL Developer - update to 23.1.0
Wildfly - update to 27.0.0
IBM Tivoli Netcool/OMNIbus Integration – Transport Module Common Integration Library - update to 36.0
fasterxml-oss-parent - update to 49-2.fc38
Operations Dashboard - update to 2022.2.1-7-lts

• https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51020
• https://github.com/FasterXML/jackson-databind/issues/3590

• Denial of service in FasterXML jackson-databind
• Denial of service in Cloud Foundry UAA
• Gentoo update for FasterXML jackson-databind
• Denial of service in IBM Sterling Connect:Direct File Agent
• Multiple vulnerabilities in Dell Secure Connect Gateway
• SUSE update for jackson-databind
• Multiple vulnerabilities in Red Hat OpenShift Logging 5.4
• Debian update for jackson-databind
• Multiple vulnerabilities in WildFly
• Multiple vulnerabilities in IBM Answer Retrieval for Watson Discovery
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in Red Hat AMQ Broker 7.10
• Multiple vulnerabilities in IBM CICS Transaction Gateway
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM Data Risk Manager
• Multiple vulnerabilities in Openshift Logging 5.3
• Multiple vulnerabilities in OpenShift Logging 5.5
• Deserialization of untrusted data in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in Red Hat build of Eclipse Vert.x
• Multiple vulnerabilities in IBM Tivoli Netcool/OMNIbus Probe and Integrations Library
• Deserialization of untrusted data in IBM Sterling Connect:Direct for UNIX
• Multiple vulnerabilities in IBM Spectrum Control
• Multiple vulnerabilities in IBM Spectrum Protect for Virtual Environments
• Multiple vulnerabilities in IBM Spectrum Protect for Space Management
• Multiple vulnerabilities in IBM Spectrum Protect Backup-Archive Client
• Multiple vulnerabilities in IBM App Connect Enterprise
• Deserialization of untrusted data in IBM Sterling Connect:Direct Web Services
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in Red Hat AMQ Streams
• Multiple vulnerabilities in Oracle Database Server
• Multiple vulnerabilities in Primavera Unifier
• Multiple vulnerabilities in Primavera Gateway
• Multiple vulnerabilities in Oracle Communications Diameter Intelligence Hub
• Deserialization of Untrusted Data in Oracle Communications Cloud Native Core Network Data Analytics Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Slice Selection Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Exposure Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Console
• Multiple vulnerabilities in Management Cloud Engine
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Deserialization of Untrusted Data in Oracle Communications Pricing Design Center
• Multiple vulnerabilities in Oracle Communications Messaging Server
• Multiple vulnerabilities in Oracle Communications Instant Messaging Server
• Deserialization of Untrusted Data in Oracle Communications Contacts Server
• Deserialization of Untrusted Data in Oracle Communications Calendar Server
• Multiple vulnerabilities in Oracle Communications Billing and Revenue Management
• Multiple vulnerabilities in Oracle Communications Unified Inventory Management
• Multiple vulnerabilities in Communications Unified Assurance
• Multiple vulnerabilities in Oracle Health Sciences Empirica Signal
• Multiple vulnerabilities in Oracle Global Lifecycle Management NextGen OUI Framework
• Deserialization of Untrusted Data in Oracle Banking Platform
• Deserialization of Untrusted Data in Oracle Banking Loans Servicing
• Multiple vulnerabilities in Oracle Financial Services Crime and Compliance Management Studio
• Multiple vulnerabilities in Oracle Banking Party Management
• Multiple vulnerabilities in Oracle Banking Enterprise Default Management
• Deserialization of Untrusted Data in Oracle Retail Service Backbone
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in Oracle Utilities Framework
• Multiple vulnerabilities in OpenShift Logging 5.6
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in FileNet Content Manager
• Deserialization of untrusted data in IBM Content Manager Enterprise Edition
• Multiple vulnerabilities in Red Hat Integration Camel Extensions for Quarkus
• Multiple vulnerabilities in Migration Toolkit for Runtimes
• Multiple vulnerabilities in IBM Planning Analytics Workspace
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in IBM MQ
• Deserialization of untrusted data in IBM Sterling Connect:Direct for Microsoft Windows
• Deserialization of untrusted data in IBM Cloud Pak for Multicloud Management Monitoring
• IBM Sterling Global Mailbox update for FasterXML jackson-databind
• Multiple vulnerabilities in Red Hat Data Grid
• Multiple vulnerabilities in IBM Common Licensing
• Multiple vulnerabilities in IBM Operations Analytics Predictive Insights
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for OpenShift
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 8
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 7
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• IBM Operations Dashboard update for jackson-databind
• OpenShift Developer Tools and Services for OCP 4.12 update for Jenkins and Jenkins-2-plugins
• Multiple vulnerabilities in Red Hat build of Quarkus
• Deserialization of untrusted data in IBM Watson CP4D Data Stores
• Multiple vulnerabilities in IBM Maximo Application Suite
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM DataPower Operations Dashboard
• Deserialization of Untrusted Data in Oracle NoSQL Database
• Deserialization of Untrusted Data in Oracle Graph Server and Client
• Deserialization of Untrusted Data in Oracle GoldenGate
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Service Communication Proxy
• Multiple vulnerabilities in Oracle WebCenter Portal
• Multiple vulnerabilities in Identity Manager
• Multiple vulnerabilities in Oracle Coherence
• Multiple vulnerabilities in Oracle Business Process Management Suite
• Deserialization of Untrusted Data in Oracle Financial Services Enterprise Case Management
• Multiple vulnerabilities in Oracle Financial Services Behavior Detection Platform
• Multiple vulnerabilities in Oracle Financial Services Analytical Applications Infrastructure
• Multiple vulnerabilities in Oracle Banking Digital Experience
• Multiple vulnerabilities in Oracle SD-WAN Edge
• Multiple vulnerabilities in Oracle Communications Session Report Manager
• Multiple vulnerabilities in Oracle Communications Policy Management
• Multiple vulnerabilities in Oracle Communications Element Manager
• Multiple vulnerabilities in Oracle Commerce Guided Search
• Multiple vulnerabilities in Oracle SQL Developer
• Multiple vulnerabilities in Oracle Healthcare Translational Research
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in JD Edwards EnterpriseOne Tools
• Multiple vulnerabilities in Oracle Documaker
• Multiple vulnerabilities in Oracle Agile PLM Framework
• Multiple vulnerabilities in Oracle Siebel CRM
• Deserialization of Untrusted Data in Oracle Retail Sales Audit
• Multiple vulnerabilities in Oracle Retail Xstore Point of Service
• Multiple vulnerabilities in Oracle Retail Merchandising System
• Multiple vulnerabilities in Oracle Retail Customer Management and Segmentation Foundation
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite
• Multiple vulnerabilities in IBM Maximo Asset Management
• Deserialization of untrusted data in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cognos Command Center
• Multiple vulnerabilities in Red Hat Integration Camel for Spring Boot
• Multiple vulnerabilities in Red Hat Satellite 6.13
• Multiple vulnerabilities in IBM Db2 Graph
• Multiple vulnerabilities in IBM Security Verify Information Queue
• Multiple vulnerabilities in IBM InfoSphere Information Server
• Multiple vulnerabilities in Red Hat AMQ Streams 2.4
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Multiple vulnerabilities in Red Hat Integration Camel for Spring Boot
• OpenShift Developer Tools and Services for OCP 4.11 update for jenkins and jenkins-2-plugins
• Multiple vulnerabilities in IBM Storage Protect Server
• Multiple vulnerabilities in IBM Cognos Analytics
• Multiple vulnerabilities in IBM i Modernization Engine for Lifecycle Integration
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Deserialization of Untrusted Data in Oracle Autovue for Agile Product Lifecycle Management
• Multiple vulnerabilities in Oracle Siebel CRM
• Multiple vulnerabilities in Dell Streaming Data Platform
• Multiple vulnerabilities in IBM App Connect for Manufacturing
• Multiple vulnerabilities in IBM OpenPages for IBM Cloud Pak for Data
• Multiple vulnerabilities in Dell PowerStore Family
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in IBM Application Performance Management products
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in IBM Jazz Reporting Service
• Multiple vulnerabilities in Red Hat Process Automation Manager 7.13
• Multiple vulnerabilities in Oracle Banking Deposits and Lines of Credit Servicing
• Jira Service Management Data Center and Server update for FasterXML jackson-databind
• Multiple vulnerabilities in IBM Engineering Lifecycle Optimization - Publishing
• Multiple vulnerabilities in IBM Sterling B2B Integrator
• Multiple vulnerabilities in third-party components in Jira Software Data Center and Server
• Multiple vulnerabilities in IBM Sterling Partner Engagement Manager Essentials Edition
• Multiple vulnerabilities in IBM Storage Fusion HCI
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Deserialization of Untrusted Data in Enterprise Manager for Virtualization
• Multiple vulnerabilities in Enterprise Manager Base Platform
• Multiple vulnerabilities in Oracle FLEXCUBE Investor Servicing
• Multiple vulnerabilities in Oracle Banking Virtual Account Management
• Multiple vulnerabilities in Oracle Banking Corporate Lending Process Management
• Multiple vulnerabilities in Oracle Banking Extensibility Workbench
• Multiple vulnerabilities in HPE Unified Mediation Bus (UMB)
• Multiple vulnerabilities in Dell Networker
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS/DWA
• Multiple vulnerabilities in QNAP QuMagie Mobile for Android
• openEuler update for jackson-databind
• openEuler 20.03 LTS SP4 update for jackson-databind
• Multiple vulnerabilities in Oracle Commerce Platform
• Multiple vulnerabilities in Oracle Identity Manager Connector
• Multiple vulnerabilities in Oracle Solaris Cluster
• Multiple vulnerabilities in IBM Integration Designer
• Multiple vulnerabilities in IBM Operational Decision Manager
• Multiple vulnerabilities in IBM MobileFirst Platform Foundation
• Crowd Data Center and Server update for jackson-databind
• Multiple vulnerabilities in Siebel CRM Deployment
• Multiple vulnerabilities in IBM Storage Virtualize
• Multiple vulnerabilities in Dell Data Protection Central
• Multiple vulnerabilities in Data Protection Advisor
• IBM watsonx.data update for FasterXML jackson-databind
• Fedora 38 update for fasterxml-oss-parent, jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-jaxrs-providers, jackson-modules-base, jackson-parent
• Multiple vulnerabilities in Guardium Data Security Center
• Multiple vulnerabilities in IBM Security QRadar EDR
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7
• Multiple vulnerabilities in IBM Netezza Performance Server Replication Services
• Multiple vulnerabilities in IBM User Entity Behavior Analytics
• Multiple vulnerabilities in Cloudera Observability on Premises with IBM
• Multiple vulnerabilities in IBM Datacap
• Multiple vulnerabilities in Oracle Banking Supply Chain Finance
• Multiple vulnerabilities in Oracle FLEXCUBE Universal Banking
• Multiple vulnerabilities in Oracle Banking Trade Finance Process Management
• Multiple vulnerabilities in Oracle Banking Treasury Management
• Multiple vulnerabilities in Oracle Banking Credit Facilities Process Management
• Multiple vulnerabilities in Oracle Banking Liquidity Management
• Multiple vulnerabilities in Oracle Banking Cash Management
• Multiple vulnerabilities in Oracle Banking Corporate Lending
• Multiple vulnerabilities in Oracle Application Testing Suite
• Multiple vulnerabilities in Stream Analytics
• Multiple vulnerabilities in Oracle Banking Trade Finance
• Multiple vulnerabilities in IBM Engineering Lifecycle Management - Jazz Foundation
• Multiple vulnerabilities in IBM webMethods BPM and IBM webMethods Integration
• Multiple vulnerabilities in IBM Financial Transaction Manager for ACH Services and Check Services for Multi-Platform
• Splunk AppDynamics Database Agent update for third-party components