NetSight
IP …
high8.1

CVE-2020-36181

Unsafe Deserialization in jackson-databind

Impact

FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS`.

Affected packages

EcosystemPackageAffectedFixed in
mavencom.fasterxml.jackson.core:jackson-databind>= 2.7.0, < 2.9.10.82.9.10.8

Affected products

VendorProductAffected versions
NetappService Level Manager
All versions
DebianDebian Linux
Version 9.0
OracleAgile Product Lifecycle Management
Version 9.3.6
OracleApplication Testing Suite
Version 13.3.0.1
OracleAutovue For Agile Product Lifecycle Management
Version 21.0.2
OracleBanking Corporate Lending Process Management
Versions 14.2, 14.3, 14.5
OracleBanking Credit Facilities Process Management
Versions 14.2, 14.3, 14.5
OracleBanking Extensibility Workbench
Versions 14.2, 14.3, 14.5
OracleBanking Supply Chain Finance
Versions 14.2, 14.3, 14.5
OracleBanking Treasury Management
Version 4.4
OracleBanking Virtual Account Management
Versions 14.2.0, 14.3.0, 14.5.0
OracleBlockchain Platform
through 21.1.2

Weakness classification

CWE-502

References