NetSight
IP …
high8.1

CVE-2020-14062

Deserialization of untrusted data in Jackson Databind

Impact

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2).

Affected packages

EcosystemPackageAffectedFixed in
mavencom.fasterxml.jackson.core:jackson-databind>= 2.9.0, <= 2.9.10.42.9.10.5

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
from 2.0.0 before 2.9.10.5
NetappActive Iq Unified Manager
from 7.3
from 9.5
NetappSteelstore Cloud Integrated Storage
All versions
DebianDebian Linux
Version 8.0
OracleAgile Product Lifecycle Management
Version 9.3.6
OracleBanking Digital Experience
Versions 18.1, 18.2, 18.3, 19.1, 19.2, 20.1
OracleCommunications Calendar Server
Version 8.0.0.4.0
OracleCommunications Contacts Server
Version 8.0.0.5.0
OracleCommunications Diameter Signaling Router
from 8.0.0 through 8.2.2
OracleCommunications Element Manager
from 8.2.0 through 8.2.2
OracleCommunications Evolved Communications Application Server
Version 7.1
OracleCommunications Session Report Manager
from 8.2.0 through 8.2.2

Weakness classification

CWE-502

References