high8.1
CVE-2020-36188
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.l…
Impact
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fasterxml | Jackson-Databind | from 2.0.0 before 2.6.7.5 from 2.7.0 before 2.9.10.8 |
| Netapp | Cloud Backup | All versions |
| Netapp | Service Level Manager | All versions |
| Debian | Debian Linux | Version 9.0 |
| Oracle | Agile Product Lifecycle Management | Version 9.3.6 |
| Oracle | Application Testing Suite | Version 13.3.0.1 |
| Oracle | Autovue For Agile Product Lifecycle Management | Version 21.0.2 |
| Oracle | Banking Corporate Lending Process Management | Versions 14.2, 14.3, 14.5 |
| Oracle | Banking Credit Facilities Process Management | Versions 14.2, 14.3, 14.5 |
| Oracle | Banking Extensibility Workbench | Versions 14.2, 14.3, 14.5 |
| Oracle | Banking Supply Chain Finance | Versions 14.2, 14.3, 14.5 |
| Oracle | Banking Treasury Management | Version 4.4 |
Weakness classification
References
- NVD record
- CVE.org record
- https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://github.com/FasterXML/jackson-databind/issues/2996
- https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html
- https://security.netapp.com/advisory/ntap-20210205-0005/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html