In short
- CVE-2020-9546 is a CRITICAL (CVSS 9.8) vulnerability affecting com.fasterxml.jackson.core:jackson-databind, jackson-databind (fasterxml), active iq unified manager (netapp).
- Chance of exploitation in the next 30 days (EPSS): 4.6%, higher than 91.6% of all vulnerabilities.
- Fix: update to 2.9.10.4, 2.7.9.7, 2.8.11.6, 12.2.0.1.20 or later.
| Package | Affected versions | Patched versions |
|---|
| com.fasterxml.jackson.core:jackson-databind Maven | ≥ 2.9.0, < 2.9.10.4
| 2.9.10.4
|
| jackson-databind | ≥ 2.0.0, < 2.7.9.7≥ 2.8.0, < 2.8.11.6≥ 2.9.0, < 2.9.10.4
| 2.7.9.72.8.11.62.9.10.4
|
| active iq unified manager | ≥ 7.3≥ 9.5
| No fix yet |
| agile product lifecycle management | = 9.3.6
| No fix yet |
| autovue for agile product lifecycle management | = 21.0.2
| No fix yet |
| banking digital experience | = 18.1= 18.2= 18.3= 19.1= 19.2= 20.1
| No fix yet |
| banking platform | ≥ 2.4.0, ≤ 2.9.0
| No fix yet |
| communications calendar server | = 8.0.0.4.0
| No fix yet |
| communications contacts server | = 8.0.0.4.0= 8.0.0.5.0
| No fix yet |
| communications diameter signaling router | ≥ 8.0.0, ≤ 8.2.2
| No fix yet |
| communications element manager | ≥ 8.2.0, ≤ 8.2.2
| No fix yet |
| communications evolved communications application server | = 7.1
| No fix yet |
| communications instant messaging server | = 10.0.1.4.0
| No fix yet |
| communications network charging and control | = 6.0.1≥ 12.0.0, ≤ 12.0.3
| No fix yet |
| communications session report manager | ≥ 8.2.0, ≤ 8.2.2
| No fix yet |
| communications session route manager | ≥ 8.2.0, ≤ 8.2.2
| No fix yet |
| enterprise manager base platform | = 13.3.0.0= 13.4.0.0
| No fix yet |
| financial services analytical applications infrastructure | ≥ 8.0.6, ≤ 8.1.0
| No fix yet |
| financial services institutional performance analytics | = 8.0.6= 8.0.7= 8.1.0= 8.7.0
| No fix yet |
| financial services price creation and discovery | = 8.0.6= 8.0.7
| No fix yet |
| financial services retail customer analytics | = 8.0.6
| No fix yet |
| global lifecycle management opatch | < 12.2.0.1.20
| 12.2.0.1.20
|
| insurance policy administration j2ee | = 11.0.2.25= 11.1.0.15
| No fix yet |
| jd edwards enterpriseone orchestrator | < 9.2.4.2
| 9.2.4.2
|
| jd edwards enterpriseone tools | < 9.2.4.2
| 9.2.4.2
|
| primavera unifier | = 16.1= 16.2= 18.8= 19.12≥ 17.7, ≤ 17.12
| No fix yet |
| retail merchandising system | = 15.0
| No fix yet |
| retail sales audit | = 14.1
| No fix yet |
| retail service backbone | = 14.1= 15.0= 16.0
| No fix yet |
| retail xstore point of service | = 15.0= 16.0= 17.0= 18.0= 19.0
| No fix yet |
| weblogic server | = 12.2.1.3.0= 12.2.1.4.0
| No fix yet |
Description
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).
NVD description
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).
More vulnerabilities in com.fasterxml.jackson.core:jackson-databind
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free