CVE-2020-14060

Description

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).

CVSS breakdown

Affected products

• FasterXML / jackson-databind2.0.0 – 2.9.10.5
• NETAPP / active_iq_unified_manager7.3 –
• NETAPP / active_iq_unified_manager7.3 –
• NETAPP / active_iq_unified_manager9.5 –
• NETAPP / steelstore_cloud_integrated_storage
• oracle / agile_product_lifecycle_management9.3.6 – 9.3.6
• oracle / banking_digital_experience18.1 – 18.1
• oracle / banking_digital_experience18.2 – 18.2
• oracle / banking_digital_experience18.3 – 18.3
• oracle / banking_digital_experience19.1 – 19.1
• oracle / banking_digital_experience19.2 – 19.2
• oracle / banking_digital_experience20.1 – 20.1
• oracle / communications_calendar_server8.0.0.4.0 – 8.0.0.4.0
• oracle / communications_contacts_server8.0.0.5.0 – 8.0.0.5.0
• oracle / communications_diameter_signaling_router8.0.0 – 8.2.2
• oracle / communications_element_manager8.2.0 – 8.2.2
• oracle / communications_evolved_communications_application_server7.1 – 7.1
• oracle / communications_session_report_manager8.2.0 – 8.2.2
• oracle / communications_session_route_manager8.2.0 – 8.2.2

References

• MISChttps://github.com/FasterXML/jackson-databind/issues/2688
• MISChttps://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
• MAILING_LISThttps://lists.debian.org/debian-lts-announce/2020/07/msg00001.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2020.html
• MISChttps://security.netapp.com/advisory/ntap-20200702-0003/
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujan2021.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuApr2021.html
• VENDOR_ADVISORYhttps://www.oracle.com//security-alerts/cpujul2021.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2021.html