CVE-2020-9548 vulnerabilities and exploits

(subscribe to this query)

FasterXML jackson-databind 2.x prior to 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

Fasterxml Jackson-databind Netapp Active Iq Unified Manager Debian Debian Linux 8.0 Oracle Agile Plm 9.3.6 Oracle Autovue For Agile Product Lifecycle Management 21.0.2 Oracle Banking Digital Experience 18.1 Oracle Banking Digital Experience 18.2 Oracle Banking Digital Experience 18.3 Oracle Banking Digital Experience 19.1 Oracle Banking Digital Experience 19.2 Oracle Banking Digital Experience 20.1 Oracle Banking Platform

1 Github repository

FasterXML jackson-databind 2.x prior to 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

Fasterxml Jackson-databind Netapp Active Iq Unified Manager Debian Debian Linux 8.0 Oracle Agile Plm 9.3.6 Oracle Autovue For Agile Product Lifecycle Management 21.0.2 Oracle Banking Digital Experience 18.1 Oracle Banking Digital Experience 18.2 Oracle Banking Digital Experience 18.3 Oracle Banking Digital Experience 19.1 Oracle Banking Digital Experience 19.2 Oracle Banking Digital Experience 20.1 Oracle Banking Platform

FasterXML jackson-databind 2.x prior to 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

Fasterxml Jackson-databind Netapp Active Iq Unified Manager Debian Debian Linux 8.0 Oracle Autovue For Agile Product Lifecycle Management 21.0.2 Oracle Banking Platform Oracle Communications Contacts Server 8.0.0.4.0 Oracle Communications Evolved Communications Application Server 7.1 Oracle Communications Instant Messaging Server 10.0.1.4.0 Oracle Communications Network Charging And Control Oracle Communications Network Charging And Control 6.0.1 Oracle Enterprise Manager Base Platform 13.3.0.0 Oracle Enterprise Manager Base Platform 13.4.0.0

2 Github repositories

A Polymorphic Typing issue exists in FasterXML jackson-databind prior to 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

Fasterxml Jackson-databind Netapp Active Iq Unified Manager Netapp Oncommand Api Services -Netapp Oncommand Workflow Automation -Netapp Service Level Manager -Netapp Steelstore Cloud Integrated Storage -Debian Debian Linux 8.0 Redhat Jboss Enterprise Application Platform 7.2 Redhat Jboss Enterprise Application Platform 7.3 Oracle Customer Management And Segmentation Foundation Oracle Goldengate Application Adapters 19.1.0.0.0 Oracle Retail Customer Management And Segmentation Foundation 17.0

SubTypeValidator.java in FasterXML jackson-databind prior to 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

Fasterxml Jackson-databind Debian Debian Linux 8.0 Netapp Active Iq Unified Manager Netapp Oncommand Workflow Automation -Netapp Service Level Manager -Netapp Snapcenter -Fedoraproject Fedora 29 Fedoraproject Fedora 30 Fedoraproject Fedora 31 Redhat Jboss Enterprise Application Platform 7.2 Redhat Jboss Enterprise Application Platform 7.3 Redhat Openshift Container Platform 4.1

1 Github repository

FasterXML jackson-databind 2.x prior to 2.9.10.2 lacks certain net.sf.ehcache blocking.

Fasterxml Jackson-databind Oracle Banking Platform Oracle Communications Billing And Revenue Management 7.5.0.23.0 Oracle Communications Billing And Revenue Management 12.0.0.3.0 Oracle Communications Cloud Native Core Network Slice Selection Function 1.2.1 Oracle Communications Contacts Server 8.0.0.4.0 Oracle Communications Evolved Communications Application Server 7.1 Oracle Communications Instant Messaging Server 10.0.1.4.0 Oracle Communications Network Charging And Control Oracle Communications Network Charging And Control 6.0.1 Oracle Customer Management And Segmentation Foundation 18.0 Oracle Enterprise Manager Base Platform 13.3.0.0

A flaw exists in jackson-databind in versions prior to 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.

Fasterxml Jackson-databind Redhat Decision Manager 7.0 Redhat Jboss Data Grid -Redhat Jboss Data Grid 7.0.0 Redhat Jboss Enterprise Application Platform 7.0 Redhat Jboss Fuse 7.0.0 Redhat Openshift Container Platform 4.3 Redhat Process Automation 7.0 Apache Geode 1.12.0

1 Github repository

A Polymorphic Typing issue exists in FasterXML jackson-databind 2.0.0 up to and including 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in ...

Fasterxml Jackson-databind Debian Debian Linux 8.0 Redhat Jboss Enterprise Application Platform 7.2 Redhat Jboss Enterprise Application Platform 7.3 Oracle Banking Platform 2.4.0 Oracle Banking Platform 2.4.1 Oracle Banking Platform 2.5.0 Oracle Banking Platform 2.6.0 Oracle Banking Platform 2.6.1 Oracle Banking Platform 2.6.2 Oracle Banking Platform 2.7.0 Oracle Banking Platform 2.7.1

2 Github repositories

A flaw exists in FasterXML jackson-databind in all versions prior to 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping(...

Fasterxml Jackson-databind Netapp Oncommand Api Services -Netapp Steelstore Cloud Integrated Storage -Oracle Goldengate Stream Analytics

H2 1.4.197, as used in Datomic prior to 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code. NOTE: the vendor's position is "h2 is not designed to be run outside of a secure environment."

Cognitect Datomic H2database H2 1.4.197

1 Github repository

1 2 3 4 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook