NetSight
IP …
high8.1

CVE-2020-24616

Code Injection in jackson-databind

Impact

This project contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).

Affected packages

EcosystemPackageAffectedFixed in
mavencom.fasterxml.jackson.core:jackson-databind>= 2.0.0, <= 2.9.10.52.9.10.6

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
from 2.0.0 before 2.9.10.6
NetappActive Iq Unified Manager
All versions
OracleAgile Product Lifecycle Management
Version 9.3.6
OracleApplication Testing Suite
Version 13.3.0.1
OracleAutovue For Agile Product Lifecycle Management
Version 21.0.2
OracleBanking Liquidity Management
Versions 14.2, 14.3, 14.5
OracleBanking Supply Chain Finance
Versions 14.2, 14.3, 14.5
OracleBlockchain Platform
before 21.1.2
OracleCommunications Calendar Server
Versions 8.0, 8.0.0.4.0
OracleCommunications Cloud Native Core Unified Data Repository
Version 1.4.0
OracleCommunications Contacts Server
Versions 8.0, 8.0.0.5.0
OracleCommunications Diameter Signaling Router
from 8.0.0 through 8.2.2

Weakness classification

CWE-502CWE-94

References