NetSight
IP …
high8.1

CVE-2020-35728

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache…

Impact

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
from 2.0.0 before 2.6.7.5
from 2.7.0 before 2.9.10.8
DebianDebian Linux
Version 9.0
NetappService Level Manager
All versions
OracleAgile Product Lifecycle Management
Version 9.3.6
OracleApplication Testing Suite
Version 13.3.0.1
OracleAutovue
Version 21.0.2
OracleBanking Corporate Lending Process Management
Versions 14.2, 14.3, 14.5
OracleBanking Credit Facilities Process Management
Versions 14.2, 14.3, 14.5
OracleBanking Extensibility Workbench
Versions 14.2, 14.3, 14.5
OracleBanking Supply Chain Finance
Versions 14.2, 14.3, 14.5
OracleBanking Treasury Management
Version 14.4
OracleBanking Virtual Account Management
Versions 14.2.0, 14.3.0, 14.5.0

Weakness classification

CWE-502

References