NetSight
IP …
critical9.8

CVE-2020-9547

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transac…

Impact

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
from 2.0.0 before 2.7.9.7
from 2.8.0 before 2.8.11.6
from 2.9.0 before 2.9.10.4
NetappActive Iq Unified Manager
from 7.3
from 9.5
DebianDebian Linux
Version 8.0
OracleAutovue For Agile Product Lifecycle Management
Version 21.0.2
OracleBanking Platform
from 2.4.0 through 2.9.0
OracleCommunications Contacts Server
Version 8.0.0.4.0
OracleCommunications Evolved Communications Application Server
Version 7.1
OracleCommunications Instant Messaging Server
Version 10.0.1.4.0
OracleCommunications Network Charging And Control
from 12.0.0 through 12.0.3
Version 6.0.1
OracleEnterprise Manager Base Platform
Versions 13.3.0.0, 13.4.0.0
OracleGlobal Lifecycle Management Opatch
before 12.2.0.1.20
OracleJd Edwards Enterpriseone Orchestrator
before 9.2.4.2

Weakness classification

CWE-502

References