NetSight
IP …
critical9.8

CVE-2019-20330

Deserialization of Untrusted Data in jackson-databind

Impact

FasterXML jackson-databind 2.x before 2.6.7.4, 2.7.x before 2.7.9.7, 2.8.x before 2.8.11.5, and 2.9.x before 2.9.10.2 lacks certain `net.sf.ehcache` blocking.

Affected packages

EcosystemPackageAffectedFixed in
mavencom.fasterxml.jackson.core:jackson-databind>= 2.7.0, <= 2.7.9.62.7.9.7

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
from 2.0.0 before 2.7.9.7
from 2.8.0 before 2.8.11.5
from 2.9.0 before 2.9.10.2
OracleBanking Platform
from 2.4.0 through 2.9.0
OracleCommunications Billing And Revenue Management
Versions 7.5.0.23.0, 12.0.0.3.0
OracleCommunications Cloud Native Core Network Slice Selection Function
Version 1.2.1
OracleCommunications Contacts Server
Version 8.0.0.4.0
OracleCommunications Evolved Communications Application Server
Version 7.1
OracleCommunications Instant Messaging Server
Version 10.0.1.4.0
OracleCommunications Network Charging And Control
from 12.0.0 through 12.0.3
Version 6.0.1
OracleCustomer Management And Segmentation Foundation
Version 18.0
OracleEnterprise Manager Base Platform
Versions 13.3.0.0, 13.4.0.0
OracleGlobal Lifecycle Management Opatch
before 11.2.0.3.23
from 12.2.0.1.0 before 12.2.0.1.19
from 13.9.4.0.0 before 13.9.4.2.1
OracleGoldengate Application Adapters
Version 19.1.0.0.0

Weakness classification

CWE-502

References