En bref
- CVE-2020-10672 est une vulnérabilité ÉLEVÉE (CVSS 8.8) touchant com.fasterxml.jackson.core:jackson-databind, jackson-databind (fasterxml), agile product lifecycle management (oracle).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 3.1%, plus élevée que 87.6% des vulnérabilités.
- Correctif : mettre à jour vers 2.9.10.4, 12.2.0.1.20, 9.2.4.2 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| com.fasterxml.jackson.core:jackson-databind Maven | ≥ 2.9.0, < 2.9.10.4
| 2.9.10.4
|
| jackson-databind | ≥ 2.9.0, < 2.9.10.4
| 2.9.10.4
|
| agile product lifecycle management | = 9.3.6
| No fix yet |
| autovue for agile product lifecycle management | = 21.0.2
| No fix yet |
| banking digital experience | = 18.1= 18.2= 18.3= 19.1= 19.2= 20.1
| No fix yet |
| banking platform | ≥ 2.4.0, ≤ 2.9.0
| No fix yet |
| communications calendar server | = 8.0.0.4.0
| No fix yet |
| communications contacts server | = 8.0.0.4.0= 8.0.0.5.0
| No fix yet |
| communications diameter signaling router | ≥ 8.0.0, ≤ 8.2.2
| No fix yet |
| communications element manager | ≥ 8.2.0, ≤ 8.2.2
| No fix yet |
| communications evolved communications application server | = 7.1
| No fix yet |
| communications instant messaging server | = 10.0.1.4.0
| No fix yet |
| communications network charging and control | = 6.0.1≥ 12.0.0, ≤ 12.0.3
| No fix yet |
| communications session report manager | ≥ 8.2.0, ≤ 8.2.2
| No fix yet |
| communications session route manager | ≥ 8.2.0, ≤ 8.2.2
| No fix yet |
| enterprise manager base platform | = 13.3.0.0= 13.4.0.0
| No fix yet |
| financial services analytical applications infrastructure | ≥ 8.0.6, ≤ 8.1.0
| No fix yet |
| financial services institutional performance analytics | = 8.0.6= 8.0.7= 8.1.0
| No fix yet |
| financial services price creation and discovery | = 8.0.6= 8.0.7
| No fix yet |
| financial services retail customer analytics | = 8.0.6
| No fix yet |
| global lifecycle management opatch | < 12.2.0.1.20
| 12.2.0.1.20
|
| insurance policy administration j2ee | = 11.0.2.25= 11.1.0.15
| No fix yet |
| jd edwards enterpriseone orchestrator | < 9.2.4.2
| 9.2.4.2
|
| jd edwards enterpriseone tools | < 9.2.4.2
| 9.2.4.2
|
| primavera unifier | = 16.1= 16.2= 18.8= 19.12≥ 17.7, ≤ 17.12
| No fix yet |
| retail merchandising system | = 15.0
| No fix yet |
| retail sales audit | = 14.1
| No fix yet |
| retail service backbone | = 14.1= 15.0= 16.0
| No fix yet |
| retail xstore point of service | = 15.0= 16.0= 17.0= 18.0= 19.0
| No fix yet |
| weblogic server | = 12.2.1.3.0= 12.2.1.4.0
| No fix yet |
Description
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).
NVD description
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).
Autres vulnérabilités de com.fasterxml.jackson.core:jackson-databind
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free