NetSight
IP …
high8.1

CVE-2020-11620

jackson-databind mishandles the interaction between serialization gadgets and typing

Impact

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).

Affected packages

EcosystemPackageAffectedFixed in
mavencom.fasterxml.jackson.core:jackson-databind>= 2.9.0, <= 2.9.10.32.9.10.4

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
from 2.9.0 before 2.9.10.4
DebianDebian Linux
Version 8.0
NetappActive Iq Unified Manager
from 7.3
from 9.5
NetappSteelstore Cloud Integrated Storage
All versions
OracleBanking Platform
from 2.4.0 through 2.9.0
OracleCommunications Contacts Server
Version 8.0.0.4.0
OracleCommunications Evolved Communications Application Server
Version 7.1
OracleCommunications Instant Messaging Server
Version 10.0.1.4.0
OracleCommunications Network Charging And Control
from 12.0.0 through 12.0.3
Version 6.0.1
OracleEnterprise Manager Base Platform
Versions 13.3.0.0, 13.4.0.0
OracleGlobal Lifecycle Management Opatch
before 12.2.0.1.20
OracleJd Edwards Enterpriseone Orchestrator
before 9.2.4.2

Weakness classification

CWE-502

References