CVE-2019-20330

CRITICAL9.8Insecure deserialization

JSON export Create alert

Description

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected products

Debian / debian_linux8.0 – 8.0
FasterXML / jackson-databind2.0.0 – 2.7.9.7
NetApp / active_iq_unified_manager7.3 –
NetApp / active_iq_unified_manager9.5 –
NetApp / active_iq_unified_manager7.3 –
NetApp / oncommand_api_services
NetApp / service_level_manager
NetApp / SnapCenter
NetApp / steelstore_cloud_integrated_storage
oracle / banking_platform2.4.0 – 2.9.0
oracle / communications_billing_and_revenue_management12.0.0.3.0 – 12.0.0.3.0
oracle / communications_billing_and_revenue_management7.5.0.23.0 – 7.5.0.23.0
oracle / communications_cloud_native_core_network_slice_selection_function1.2.1 – 1.2.1
oracle / communications_contacts_server8.0.0.4.0 – 8.0.0.4.0
oracle / communications_evolved_communications_application_server7.1 – 7.1
oracle / communications_instant_messaging_server10.0.1.4.0 – 10.0.1.4.0
oracle / communications_network_charging_and_control12.0.0 – 12.0.3
oracle / communications_network_charging_and_control6.0.1 – 6.0.1
oracle / customer_management_and_segmentation_foundation18.0 – 18.0
oracle / enterprise_manager_base_platform13.4.0.0 – 13.4.0.0
oracle / enterprise_manager_base_platform13.3.0.0 – 13.3.0.0
oracle / global_lifecycle_management_opatch11.2.0.3.23
oracle / goldengate_application_adapters19.1.0.0.0 – 19.1.0.0.0
oracle / goldengate_stream_analytics19.1.0.0.1
oracle / jd_edwards_enterpriseone_orchestrator9.2.4.2
oracle / jd_edwards_enterpriseone_tools9.2.4.2
oracle / primavera_unifier19.12 – 19.12
oracle / primavera_unifier18.8 – 18.8
oracle / primavera_unifier17.7 – 17.12
oracle / primavera_unifier16.1 – 16.1
oracle / primavera_unifier16.2 – 16.2
oracle / retail_merchandising_system16.0.2 – 16.0.2
oracle / retail_merchandising_system16.0.3 – 16.0.3
oracle / retail_merchandising_system15.0.3 – 15.0.3
oracle / retail_sales_audit14.1 – 14.1
oracle / retail_xstore_point_of_service15.0 – 15.0
oracle / retail_xstore_point_of_service16.0 – 16.0
oracle / retail_xstore_point_of_service17.0 – 17.0
oracle / retail_xstore_point_of_service18.0 – 18.0
oracle / retail_xstore_point_of_service19.0 – 19.0
oracle / siebel_engineering_-_installer_&_deployment2.20.5
oracle / Siebel UI Framework20.5
oracle / trace_file_analyzer18c – 18c
oracle / trace_file_analyzer19c – 19c
oracle / trace_file_analyzer12.2.0.1 – 12.2.0.1
oracle / webcenter_portal12.2.1.3.0 – 12.2.1.3.0
oracle / webcenter_portal12.2.1.4.0 – 12.2.1.4.0
oracle / weblogic_server12.2.1.4.0 – 12.2.1.4.0
oracle / weblogic_server12.2.1.3.0 – 12.2.1.3.0

References

Updated 15m ago · 8 sources