Description
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- debian / debian_linux8.0 – 8.0
- FasterXML / jackson-databind2.9.0 – 2.9.10.5
- NETAPP / active_iq_unified_manager7.3 –
- NETAPP / active_iq_unified_manager9.5 –
- NETAPP / active_iq_unified_manager7.3 –
- NETAPP / steelstore_cloud_integrated_storage
- oracle / agile_product_lifecycle_management9.3.6 – 9.3.6
- oracle / autovue_for_agile_product_lifecycle_management21.0.2 – 21.0.2
- oracle / banking_digital_experience19.1 – 19.1
- oracle / banking_digital_experience18.1 – 18.1
- oracle / banking_digital_experience18.2 – 18.2
- oracle / banking_digital_experience18.3 – 18.3
- oracle / banking_digital_experience19.2 – 19.2
- oracle / banking_digital_experience20.1 – 20.1
- oracle / communications_calendar_server8.0.0.4.0 – 8.0.0.4.0
- oracle / communications_contacts_server8.0.0.5.0 – 8.0.0.5.0
- oracle / communications_diameter_signaling_router8.0.0 – 8.2.2
- oracle / communications_element_manager8.2.0 – 8.2.2
- oracle / communications_evolved_communications_application_server7.1 – 7.1
- oracle / communications_instant_messaging_server10.0.1.4.0 – 10.0.1.4.0
- oracle / communications_session_report_manager8.2.0 – 8.2.2
- oracle / communications_session_route_manager8.2.0 – 8.2.2
References
- MISChttps://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- MISChttps://github.com/FasterXML/jackson-databind/issues/2698
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2020/07/msg00001.html
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2020.html
- MISChttps://security.netapp.com/advisory/ntap-20200702-0003/
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujan2021.html
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuApr2021.html
- VENDOR_ADVISORYhttps://www.oracle.com//security-alerts/cpujul2021.html
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2021.html
Updated 20m ago · 8 sources