CVE-2020-9547

EPSS 53.63%
Published 02.03.2020 04:15:11
Last modified 21.11.2024 05:40:50
Source cve@mitre.org
Teams watchlist Login
Open Login

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

Affected products Warnungen 0 Metrics 3 CWE 1 References 26

Data is provided by the National Vulnerability Database (NVD)

Fasterxml ≫ Jackson-databind Version >= 2.0.0 < 2.7.9.7

Fasterxml ≫ Jackson-databind Version >= 2.8.0 < 2.8.11.6

Fasterxml ≫ Jackson-databind Version >= 2.9.0 < 2.9.10.4

Netapp ≫ Active Iq Unified Manager SwPlatformlinux Version >= 7.3

Netapp ≫ Active Iq Unified Manager SwPlatformwindows Version >= 7.3

Netapp ≫ Active Iq Unified Manager SwPlatformvmware_vsphere Version >= 9.5

Debian ≫ Debian Linux Version8.0

Oracle ≫ Autovue For Agile Product Lifecycle Management Version21.0.2

Oracle ≫ Banking Platform Version >= 2.4.0 <= 2.9.0

Oracle ≫ Communications Contacts Server Version8.0.0.4.0

Oracle ≫ Communications Evolved Communications Application Server Version7.1

Oracle ≫ Communications Instant Messaging Server Version10.0.1.4.0

Oracle ≫ Communications Network Charging And Control Version >= 12.0.0 <= 12.0.3

Oracle ≫ Communications Network Charging And Control Version6.0.1

Oracle ≫ Enterprise Manager Base Platform Version13.3.0.0

Oracle ≫ Enterprise Manager Base Platform Version13.4.0.0

Oracle ≫ Global Lifecycle Management Opatch Version < 12.2.0.1.20

Oracle ≫ Jd Edwards Enterpriseone Orchestrator Version < 9.2.4.2

Oracle ≫ Jd Edwards Enterpriseone Tools Version < 9.2.4.2

Oracle ≫ Primavera Unifier Version >= 17.7 <= 17.12

Oracle ≫ Primavera Unifier Version16.1

Oracle ≫ Primavera Unifier Version16.2

Oracle ≫ Primavera Unifier Version18.8

Oracle ≫ Primavera Unifier Version19.12

Oracle ≫ Retail Xstore Point Of Service Version15.0

Oracle ≫ Retail Xstore Point Of Service Version16.0

Oracle ≫ Retail Xstore Point Of Service Version17.0

Oracle ≫ Retail Xstore Point Of Service Version18.0

Oracle ≫ Retail Xstore Point Of Service Version19.0

Oracle ≫ Weblogic Server Version12.2.1.3.0

Oracle ≫ Weblogic Server Version12.2.1.4.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	53.63%	0.979

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	6.8	8.6	6.4	AV:N/AC:M/Au:N/C:P/I:P/A:P

CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://www.oracle.com/security-alerts/cpujan2021.html

Patch

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Patch

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Patch

Third Party Advisory

https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E

https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062

https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3E

https://lists.apache.org/thread.html/r893a0104e50c1c2559eb9a5812add28ae8c3e5f43712947a9847ec18%40%3Cnotifications.zookeeper.apache.org%3E

https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3E

https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3E

https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3E

https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3E

https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3E

https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3E

https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html

Third Party Advisory

Mailing List

https://security.netapp.com/advisory/ntap-20200904-0006/

Third Party Advisory

https://github.com/FasterXML/jackson-databind/issues/2634

Patch

Third Party Advisory

https://lists.apache.org/thread.html/r4accb2e0de9679174efd3d113a059bab71ff3ec53e882790d21c1cc1%40%3Cnotifications.zookeeper.apache.org%3E

https://lists.apache.org/thread.html/r742ef70d126548dcf7de5be5779355c9d76a9aec71d7a9ef02c6398a%40%3Cnotifications.zookeeper.apache.org%3E

https://lists.apache.org/thread.html/ra3e90712f2d59f8cef03fa796f5adf163d32b81fe7b95385f21790e6%40%3Cnotifications.zookeeper.apache.org%3E

https://lists.apache.org/thread.html/rc0d5d0f72da1ed6fc5e438b1ddb3fa090c73006b55f873cf845375ab%40%3Cnotifications.zookeeper.apache.org%3E

https://lists.apache.org/thread.html/rd0e958d6d5c5ee16efed73314cd0e445c8dbb4bdcc80fc9d1d6c11fc%40%3Cdev.zookeeper.apache.org%3E

https://lists.apache.org/thread.html/redbe4f1e21bf080f637cf9fbec47729750a2f443a919765360337428%40%3Cnotifications.zookeeper.apache.org%3E

https://nvd.nist.gov/vuln/detail/CVE-2020-9547

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2020-9547

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2020-9547

EUVD