NetSight
IP …
high8.1

CVE-2020-11619

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.M…

Impact

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
from 2.0.0 before 2.9.10.4
DebianDebian Linux
Version 8.0
NetappActive Iq Unified Manager
from 7.3
from 9.5
NetappSteelstore Cloud Integrated Storage
All versions
OracleAgile Product Lifecycle Management
Version 9.3.6
OracleBanking Platform
from 2.4.0 through 2.9.0
OracleCommunications Calendar Server
Version 8.0.0.4.0
OracleCommunications Contacts Server
Versions 8.0.0.4.0, 8.0.0.5.0
OracleCommunications Diameter Signaling Router
from 8.0.0 through 8.2.2
OracleCommunications Evolved Communications Application Server
Version 7.1
OracleCommunications Instant Messaging Server
Version 10.0.1.4.0
OracleCommunications Network Charging And Control
from 12.0.0 through 12.0.3
Version 6.0.1

Weakness classification

CWE-502

References