NetSight
IP …
critical9.8

CVE-2020-9546

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zax…

Impact

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
from 2.0.0 before 2.7.9.7
from 2.8.0 before 2.8.11.6
from 2.9.0 before 2.9.10.4
NetappActive Iq Unified Manager
from 7.3
from 9.5
DebianDebian Linux
Version 8.0
OracleAgile Product Lifecycle Management
Version 9.3.6
OracleAutovue For Agile Product Lifecycle Management
Version 21.0.2
OracleBanking Digital Experience
Versions 18.1, 18.2, 18.3, 19.1, 19.2, 20.1
OracleBanking Platform
from 2.4.0 through 2.9.0
OracleCommunications Calendar Server
Version 8.0.0.4.0
OracleCommunications Contacts Server
Versions 8.0.0.4.0, 8.0.0.5.0
OracleCommunications Diameter Signaling Router
from 8.0.0 through 8.2.2
OracleCommunications Element Manager
from 8.2.0 through 8.2.2
OracleCommunications Evolved Communications Application Server
Version 7.1

Weakness classification

CWE-502

References