title: Red Hat Security Advisory: Red Hat JBoss Data Virtualization 6.4.8 security update
description: thrift: Improper file path sanitization in t_go_generator.cc:format_go_output() of the go client library can allow an attacker to inject commands tika: Command injection in tika-server can allow remote attackers to execute arbitrary commands via crafted headers slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis thrift: Improper Access Control grants access to files outside the  webservers docroot path jackson-databind: improper polymorphic deserialization of types from Jodd-db library jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver jackson-databind: arbitrary code execution in slf4j-ext class jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes jackson-databind: improper polymorphic deserialization in axis2-transport-jms class jackson-databind: improper polymorphic deserialization in openjpa class jackson-databind: improper polymorphic deserialization in jboss-common-core class zookeeper: Information disclosure in Apache ZooKeeper
cpes: cpe:/a:redhat:jboss_data_virtualization:6.4