NetSight
IP …
critical9.8

CVE-2020-8840

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

Impact

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
from 2.0.0 before 2.7.9.7
from 2.8.0 before 2.8.11.5
from 2.9.0 before 2.9.10.3
DebianDebian Linux
Version 8.0
NetappOncommand Api Services
All versions
NetappOncommand Workflow Automation
All versions
NetappService Level Manager
All versions
NetappSteelstore Cloud Integrated Storage
All versions
HuaweiOceanstor 9000 Firmware
Versions v300r006c20, v300r006c20spc100, v300r006c20spc200, v300r006c20spc300
OracleGlobal Lifecycle Management Opatch
before 11.2.0.3.23
from 12.2.0.1.0 before 12.2.0.1.19
from 13.9.4.0.0 before 13.9.4.2.1

Weakness classification

CWE-502

References