8.1

CVE-2020-36189

Exploit
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fasterxml ≫ Jackson-databind Version >= 2.0.0 < 2.6.7.5
Fasterxml ≫ Jackson-databind Version >= 2.7.0 < 2.9.10.8
Netapp ≫ Cloud Backup Version -
Debian ≫ Debian Linux Version 9.0
Oracle ≫ Application Testing Suite Version 13.3.0.1
Oracle ≫ Banking Platform Version 2.6.2
Oracle ≫ Banking Platform Version 2.7.0
Oracle ≫ Banking Platform Version 2.7.1
Oracle ≫ Banking Platform Version 2.8.0
Oracle ≫ Banking Platform Version 2.9.0
Oracle ≫ Banking Platform Version 2.10.0
Oracle ≫ Blockchain Platform Version <= 21.1.2
Oracle ≫ Commerce Platform Version >= 11.3.0 <= 11.3.2
Oracle ≫ Commerce Platform Version 11.2.0
Oracle ≫ Communications Diameter Signaling Router Version >= 8.0.0 <= 8.5.0
Oracle ≫ Communications Session Route Manager Version >= 8.2.0.0 <= 8.2.2.1
Oracle ≫ Documaker Version 12.6.3
Oracle ≫ Documaker Version 12.6.4
Oracle ≫ Goldengate Application Adapters Version 19.1.0.0.0
Oracle ≫ Insurance Policy Administration Version >= 11.1.0 <= 11.3.0
Oracle ≫ Insurance Rules Palette Version >= 11.1.0 <= 11.3.0
Oracle ≫ Insurance Rules Palette Version 11.0.2
Oracle ≫ Jd Edwards Enterpriseone Tools Version <= 9.2.5.3
Oracle ≫ Primavera Gateway Version >= 17.12.0 <= 17.12.11
Oracle ≫ Primavera Gateway Version >= 18.8.0 <= 18.8.11
Oracle ≫ Primavera Gateway Version >= 19.12.0 <= 19.12.10
Oracle ≫ Primavera Gateway Version 20.12.0
Oracle ≫ Primavera Unifier Version >= 17.7 <= 17.12
Oracle ≫ Primavera Unifier Version 18.8
Oracle ≫ Primavera Unifier Version 19.12
Oracle ≫ Primavera Unifier Version 20.12
Oracle ≫ Retail Merchandising System Version 15.0.3
Oracle ≫ Retail Service Backbone Version 14.1.3.2
Oracle ≫ Retail Service Backbone Version 15.0.3.1
Oracle ≫ Retail Service Backbone Version 16.0.3
Oracle ≫ Webcenter Portal Version 12.2.1.3.0
Oracle ≫ Webcenter Portal Version 12.2.1.4.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.91% 0.91
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.1 2.2 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
Patch
Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2021.html
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html
Third Party Advisory
Mailing List
https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
Third Party Advisory
Exploit
Technical Description
https://security.netapp.com/advisory/ntap-20210205-0005/
Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2996
Third Party Advisory
Issue Tracking