İçeriğe geç
Bilgi ve Teknoloji Uygulamada aç

Kritik CVSS 9.8

CVE-2020-8840: Jackson-databind: güvenilmeyen verinin serileştirmeden çıkarılması

Yayın: · Güncelleme:

Açıklama (NVD)

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

Özet bilgiler

Ürün
Fasterxml Jackson-databind
CVSS v3.1
9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
%26,59 (yüzdelik 98)
CWE
CWE-502
Yama
Yok / bilinmiyor

Etkilenen sürümler

ÜrünBaşlangıçBitişDüzeltildi
fasterxml-jackson-databind2.0.0—2.7.9.7
fasterxml-jackson-databind2.8.0—2.8.11.5
fasterxml-jackson-databind2.9.0—2.9.10.3
debian-debian-linux8.08.0—
netapp-oncommand-api-services———
netapp-oncommand-workflow-automation———
netapp-service-level-manager———
netapp-steelstore-cloud-integrated-storage———
huawei-oceanstor-9000-firmwarev300r006c20v300r006c20—
huawei-oceanstor-9000-firmwarev300r006c20spc100v300r006c20spc100—
huawei-oceanstor-9000-firmwarev300r006c20spc200v300r006c20spc200—
huawei-oceanstor-9000-firmwarev300r006c20spc300v300r006c20spc300—
oracle-global-lifecycle-management-opatch——11.2.0.3.23
oracle-global-lifecycle-management-opatch12.2.0.1.0—12.2.0.1.19
oracle-global-lifecycle-management-opatch13.9.4.0.0—13.9.4.2.1

Kaynaklar

Uygulamada aç Tüm CVE kayıtları