CVE-2020-11112

Fixed in a distro release EPSS 4%CVSS 8.8

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).

Published 2020-03-31 · CVE record · OSV

Products: FasterXML jackson-databind, debian_linux, netapp steelstore_cloud_integrated_storage, oracle agile_plm, oracle autovue_for_agile_product_lifecycle_management, oracle banking_digital_experience, oracle communications_calendar_server, oracle communications_diameter_signaling_router, oracle communications_element_manager, oracle communications_evolved_communications_application_server, oracle communications_instant_messaging_server, oracle communications_network_charging_and_control, oracle communications_session_route_manager, oracle enterprise_manager_base_platform, oracle financial_services_analytical_applications_infrastructure, oracle financial_services_institutional_performance_analytics, oracle financial_services_price_creation_and_discovery, oracle financial_services_retail_customer_analytics, oracle global_lifecycle_management_opatch, oracle insurance_policy_administration_j2ee, oracle jd_edwards_enterpriseone_orchestrator, oracle primavera_unifier, oracle retail_merchandising_system, oracle retail_sales_audit, oracle retail_service_backbone, oracle retail_xstore_point_of_service, Oracle WebLogic Server

Fixed upstream

Distro releases