CVE-2020-11620

Fixed in a distro release EPSS 6%

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).

Published 2020-04-07 · CVE record · OSV

Products: FasterXML jackson-databind, debian_linux, netapp active_iq_unified_manager, netapp steelstore_cloud_integrated_storage, oracle banking_platform, oracle communications_contacts_server, oracle communications_evolved_communications_application_server, oracle communications_instant_messaging_server, oracle communications_network_charging_and_control, oracle enterprise_manager_base_platform, oracle global_lifecycle_management_opatch, oracle jd_edwards_enterpriseone_orchestrator, oracle jd_edwards_enterpriseone_tools, oracle primavera_unifier, oracle retail_merchandising_system, oracle retail_sales_audit, oracle retail_xstore_point_of_service, oracle weblogic_server

Fixed upstream

Distro releases