CVE-2020-36179
high · 8.1FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.
8.1
CVSS
21.0%
EPSS (exploit prob.)
97th
EPSS percentile
2021-01-07
Published
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| netapp | cloud_backup | all versions |
| netapp | service_level_manager | all versions |
| debian | debian_linux | 9.0 |
| oracle | agile_product_lifecycle_management | 9.3.6 |
| oracle | application_testing_suite | 13.3.0.1 |
| oracle | autovue_for_agile_product_lifecycle_management | 21.0.2 |
| oracle | banking_corporate_lending_process_management | 14.2 |
| oracle | banking_corporate_lending_process_management | 14.3 |
| oracle | banking_corporate_lending_process_management | 14.5 |
| oracle | banking_credit_facilities_process_management | 14.2 |
| oracle | banking_credit_facilities_process_management | 14.3 |
| oracle | banking_credit_facilities_process_management | 14.5 |
| oracle | banking_supply_chain_finance | 14.2 |
| oracle | banking_supply_chain_finance | 14.3 |
| oracle | banking_supply_chain_finance | 14.5 |
| oracle | banking_treasury_management | 14.4 |
| oracle | banking_virtual_account_management | 14.2.0 |
| oracle | banking_virtual_account_management | 14.3.0 |
| oracle | banking_virtual_account_management | 14.5.0 |
| oracle | blockchain_platform | <= 21.1.2 |
| oracle | commerce_platform | >= 11.3.0, <= 11.3.2 |
| oracle | commerce_platform | 11.2.0 |
| oracle | communications_billing_and_revenue_management | 7.5.0.23.0 |
| oracle | communications_billing_and_revenue_management | 12.0.0.3.0 |
| oracle | communications_cloud_native_core_policy | 1.14.0 |
| oracle | communications_cloud_native_core_unified_data_repository | 1.4.0 |
| oracle | communications_convergent_charging_controller | 12.0.4.0.0 |
| oracle | communications_diameter_signaling_route | >= 8.0.0.0, <= 8.5.0.0 |
| oracle | communications_element_manager | >= 8.2.0.0, <= 8.2.4.0 |
| oracle | communications_evolved_communications_application_server | 7.1 |
| oracle | communications_instant_messaging_server | 10.0.1.5.0 |
| oracle | communications_network_charging_and_control | 12.0.4.0.0 |
| oracle | communications_offline_mediation_controller | 12.0.0.3 |
| oracle | communications_policy_management | 12.5.0 |
| oracle | communications_pricing_design_center | 12.0.0.4.0 |
| oracle | communications_services_gatekeeper | 7.0 |
| oracle | communications_session_report_manager | >= 8.0.0.0, <= 8.2.2.1 |
| oracle | communications_session_route_manager | >= 8.2.0, <= 8.2.2.1 |
| oracle | communications_unified_inventory_management | 7.4.1 |
| oracle | data_integrator | 12.2.1.4.0 |
Check a specific version with /api/v1/cve/match.
References
- https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://github.com/FasterXML/jackson-databind/issues/3004
- https://lists.apache.org/thread.html/rc255f41d9a61d3dc79a51fb5c713de4ae10e71e3673feeb0b180b436%40%3Cissues.spark.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html
- https://security.netapp.com/advisory/ntap-20210205-0005/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://github.com/FasterXML/jackson-databind/issues/3004
- https://lists.apache.org/thread.html/rc255f41d9a61d3dc79a51fb5c713de4ae10e71e3673feeb0b180b436%40%3Cissues.spark.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html
- https://security.netapp.com/advisory/ntap-20210205-0005/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2020-36179