NetSight
IP …
high8.1

CVE-2020-35490

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasou…

Impact

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
from 2.0.0 before 2.9.10.8
NetappService Level Manager
All versions
DebianDebian Linux
Version 9.0
OracleAgile Product Lifecycle Management
Version 9.3.6
OracleApplication Testing Suite
Version 13.3.0.1
OracleAutovue For Agile Product Lifecycle Management
Version 21.0.2
OracleBanking Platform
Versions 2.6.2, 2.7.0, 2.7.1, 2.8.0, 2.9.0, 2.10.0
OracleBanking Treasury Management
Version 14.4
OracleBanking Virtual Account Management
Versions 14.2.0, 14.3.0, 14.5.0
OracleBlockchain Platform
through 21.1.2
OracleCommunications Cloud Native Core Policy
Version 1.14.0
OracleCommunications Cloud Native Core Unified Data Repository
Version 1.4.0

Weakness classification

CWE-502

References