Kurz gesagt
- CVE-2020-9548 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in com.fasterxml.jackson.core:jackson-databind, jackson-databind (fasterxml), active iq unified manager (netapp).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 18.9%, höher als bei 97.3% aller Schwachstellen.
- Abhilfe: auf 2.7.9.7, 2.8.11.6, 2.9.10.4, 12.2.0.1.20 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| com.fasterxml.jackson.core:jackson-databind Maven | ≥ 2.0.0, < 2.7.9.7≥ 2.8.0, < 2.8.11.6≥ 2.9.0, < 2.9.10.4
| 2.7.9.72.8.11.62.9.10.4
|
| jackson-databind | ≥ 2.0.0, < 2.7.9.7≥ 2.8.0, < 2.8.11.6≥ 2.9.0, < 2.9.10.4
| 2.7.9.72.8.11.62.9.10.4
|
| active iq unified manager | ≥ 7.3≥ 9.5
| No fix yet |
| agile product lifecycle management | = 9.3.6
| No fix yet |
| autovue for agile product lifecycle management | = 21.0.2
| No fix yet |
| banking digital experience | = 18.1= 18.2= 18.3= 19.1= 19.2= 20.1
| No fix yet |
| banking platform | ≥ 2.4.0, ≤ 2.9.0
| No fix yet |
| communications calendar server | = 8.0.0.4.0
| No fix yet |
| communications contacts server | = 8.0.0.4.0= 8.0.0.5.0
| No fix yet |
| communications diameter signaling router | ≥ 8.0.0, ≤ 8.2.2
| No fix yet |
| communications element manager | ≥ 8.2.0, ≤ 8.2.2
| No fix yet |
| communications evolved communications application server | = 7.1
| No fix yet |
| communications instant messaging server | = 10.0.1.4.0
| No fix yet |
| communications network charging and control | = 6.0.1≥ 12.0.0, ≤ 12.0.3
| No fix yet |
| communications session report manager | ≥ 8.2.0, ≤ 8.2.2
| No fix yet |
| communications session route manager | ≥ 8.2.0, ≤ 8.2.2
| No fix yet |
| enterprise manager base platform | = 13.3.0.0= 13.4.0.0
| No fix yet |
| global lifecycle management opatch | < 12.2.0.1.20
| 12.2.0.1.20
|
| jd edwards enterpriseone orchestrator | < 9.2.4.2
| 9.2.4.2
|
| jd edwards enterpriseone tools | < 9.2.4.2
| 9.2.4.2
|
| primavera unifier | = 16.1= 16.2= 18.8= 19.12≥ 17.7, ≤ 17.12
| No fix yet |
| retail merchandising system | = 15.0
| No fix yet |
| retail sales audit | = 14.1
| No fix yet |
| retail xstore point of service | = 15.0= 16.0= 17.0= 18.0= 19.0
| No fix yet |
| weblogic server | = 12.2.1.3.0= 12.2.1.4.0
| No fix yet |
Description
FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
NVD description
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
Weitere Schwachstellen in com.fasterxml.jackson.core:jackson-databind
Alle anzeigen →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free