high8.1
CVE-2020-14195
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRea…
Impact
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fasterxml | Jackson-Databind | from 2.9.0 before 2.9.10.5 |
| Netapp | Active Iq Unified Manager | from 7.3 from 9.5 |
| Netapp | Steelstore Cloud Integrated Storage | All versions |
| Debian | Debian Linux | Version 8.0 |
| Oracle | Agile Product Lifecycle Management | Version 9.3.6 |
| Oracle | Banking Digital Experience | Versions 18.1, 18.2, 18.3, 19.1, 19.2, 20.1 |
| Oracle | Communications Calendar Server | Version 8.0.0.4.0 |
| Oracle | Communications Contacts Server | Version 8.0.0.5.0 |
| Oracle | Communications Diameter Signaling Router | from 8.0.0 through 8.2.2 |
| Oracle | Communications Element Manager | from 8.2.0 through 8.2.2 |
| Oracle | Communications Evolved Communications Application Server | Version 7.1 |
| Oracle | Communications Instant Messaging Server | Version 10.0.1.4.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/FasterXML/jackson-databind/issues/2765
- https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html
- https://security.netapp.com/advisory/ntap-20200702-0003/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpuoct2021.html