CVE-2020-14060
Fixed in a distro release EPSS 9%
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).
Products: FasterXML jackson-databind, netapp active_iq_unified_manager, netapp steelstore_cloud_integrated_storage, oracle agile_product_lifecycle_management, oracle banking_digital_experience, oracle communications_calendar_server, oracle communications_contacts_server, oracle communications_diameter_signaling_router, oracle communications_element_manager, oracle communications_evolved_communications_application_server, oracle communications_session_report_manager, oracle communications_session_route_manager
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | com.fasterxml.jackson.core:jackson-databind | 2.9.10.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | eco-java-gradle-4.10 | no fix |
| Chainguard | eco-java-gradle-4.10.1 | no fix |
| Chainguard | eco-java-gradle-4.10.2 | no fix |
| Chainguard | eco-java-gradle-4.10.3 | no fix |
| Chainguard | eco-java-gradle-4.9 | no fix |
| Chainguard | eco-java-gradle-5.0 | no fix |
| Chainguard | eco-java-gradle-5.1 | no fix |
| Chainguard | eco-java-gradle-5.1.1 | no fix |
| Chainguard | eco-java-gradle-5.2 | no fix |
| Chainguard | eco-java-gradle-5.2.1 | no fix |
| Chainguard | eco-java-gradle-5.3 | no fix |
| Chainguard | eco-java-gradle-5.3.1 | no fix |
| Chainguard | eco-java-gradle-5.4 | no fix |
| Chainguard | eco-java-gradle-5.4.1 | no fix |
| Chainguard | eco-java-gradle-5.5 | no fix |
| Chainguard | eco-java-gradle-5.5.1 | no fix |
| Chainguard | eco-java-gradle-5.6 | no fix |
| Chainguard | eco-java-gradle-5.6.1 | no fix |
| Chainguard | eco-java-gradle-5.6.2 | no fix |
| Chainguard | eco-java-gradle-5.6.3 | no fix |
| Chainguard | eco-java-gradle-5.6.4 | no fix |
| Chainguard | eco-java-gradle-6.0 | no fix |
| Chainguard | eco-java-gradle-6.0.1 | no fix |
| Chainguard | eco-java-gradle-6.1 | no fix |
| Chainguard | eco-java-gradle-6.1.1 | no fix |
| Chainguard | eco-java-gradle-6.2 | no fix |
| Chainguard | eco-java-gradle-6.2.1 | no fix |
| Chainguard | eco-java-gradle-6.2.2 | no fix |
| Debian 12 | jackson-databind | 2.11.1-1 |
| Debian 13 | jackson-databind | 2.11.1-1 |
| Debian 14 | jackson-databind | 2.11.1-1 |
| Debian 8 | jackson-databind | 2.4.2-2+deb8u15 |
| Red Hat satellite 6.6 | candlepin | 0:2.6.16-1.el7sat |
| Red Hat satellite 6.6 | candlepin-selinux | 0:2.6.16-1.el7sat |
| Red Hat satellite 6.6 | foreman | 0:1.22.0.39-2.el7sat |
| Red Hat satellite 6.6 | foreman-cli | 0:1.22.0.39-2.el7sat |
| Red Hat satellite 6.6 | foreman-debug | 0:1.22.0.39-2.el7sat |
| Red Hat satellite 6.6 | foreman-ec2 | 0:1.22.0.39-2.el7sat |
| Red Hat satellite 6.6 | foreman-gce | 0:1.22.0.39-2.el7sat |
| Red Hat satellite 6.6 | foreman-journald | 0:1.22.0.39-2.el7sat |
| Red Hat satellite 6.6 | foreman-libvirt | 0:1.22.0.39-2.el7sat |
| Red Hat satellite 6.6 | foreman-openstack | 0:1.22.0.39-2.el7sat |
| Red Hat satellite 6.6 | foreman-ovirt | 0:1.22.0.39-2.el7sat |
| Red Hat satellite 6.6 | foreman-postgresql | 0:1.22.0.39-2.el7sat |
| Red Hat satellite 6.6 | foreman-rackspace | 0:1.22.0.39-2.el7sat |
| Red Hat satellite 6.6 | foreman-telemetry | 0:1.22.0.39-2.el7sat |
| Red Hat satellite 6.6 | foreman-vmware | 0:1.22.0.39-2.el7sat |
| Red Hat satellite 6.6 | satellite | 0:6.6.3-1.el7sat |
| Red Hat satellite 6.6 | satellite-capsule | 0:6.6.3-1.el7sat |
| Red Hat satellite 6.6 | satellite-cli | 0:6.6.3-1.el7sat |
| Red Hat satellite 6.6 | satellite-common | 0:6.6.3-1.el7sat |
| Red Hat satellite 6.6 | satellite-debug-tools | 0:6.6.3-1.el7sat |
| Red Hat satellite 6.6 | tfm-rubygem-fog-ovirt | 0:1.2.3-1.el7sat |
| Red Hat satellite 6.6 | tfm-rubygem-foreman_rh_cloud | 0:0.9.4.1-2.el7sat |
| Red Hat satellite 6.6 | tfm-rubygem-katello | 0:3.12.0.41-1.el7sat |
| Red Hat satellite 6.6 | tfm-rubygem-runcible | 0:2.13.0-1.el7sat |
| Red Hat satellite 6.7 | candlepin | 0:2.9.28-1.el7sat |
| Red Hat satellite 6.7 | candlepin-selinux | 0:2.9.28-1.el7sat |
| Red Hat satellite 6.7 | foreman | 0:1.24.1.24-1.el7sat |
| Red Hat satellite 6.7 | foreman-cli | 0:1.24.1.24-1.el7sat |
| Red Hat satellite 6.7 | foreman-debug | 0:1.24.1.24-1.el7sat |
| Red Hat satellite 6.7 | foreman-ec2 | 0:1.24.1.24-1.el7sat |
| Red Hat satellite 6.7 | foreman-gce | 0:1.24.1.24-1.el7sat |
| Red Hat satellite 6.7 | foreman-installer | 1:1.24.1.21-1.el7sat |
| Red Hat satellite 6.7 | foreman-installer-katello | 1:1.24.1.21-1.el7sat |
| Red Hat satellite 6.7 | foreman-journald | 0:1.24.1.24-1.el7sat |
| Red Hat satellite 6.7 | foreman-libvirt | 0:1.24.1.24-1.el7sat |
| Red Hat satellite 6.7 | foreman-openstack | 0:1.24.1.24-1.el7sat |
| Red Hat satellite 6.7 | foreman-ovirt | 0:1.24.1.24-1.el7sat |
| Red Hat satellite 6.7 | foreman-postgresql | 0:1.24.1.24-1.el7sat |
| Red Hat satellite 6.7 | foreman-rackspace | 0:1.24.1.24-1.el7sat |
| Red Hat satellite 6.7 | foreman-telemetry | 0:1.24.1.24-1.el7sat |
| Red Hat satellite 6.7 | foreman-vmware | 0:1.24.1.24-1.el7sat |
| Red Hat satellite 6.7 | pulp-rpm | 0:2.21.0.6-1.el7sat |
| Red Hat satellite 6.7 | pulp-rpm-admin-extensions | 0:2.21.0.6-1.el7sat |
| Red Hat satellite 6.7 | pulp-rpm-plugins | 0:2.21.0.6-1.el7sat |
| Red Hat satellite 6.7 | python-pulp-integrity | 0:2.21.0.6-1.el7sat |
| Red Hat satellite 6.7 | python-pulp-rpm-common | 0:2.21.0.6-1.el7sat |
| Red Hat satellite 6.7 | satellite | 0:6.7.2-1.el7sat |
| Red Hat satellite 6.7 | satellite-capsule | 0:6.7.2-1.el7sat |
| Red Hat satellite 6.7 | satellite-cli | 0:6.7.2-1.el7sat |
| Red Hat satellite 6.7 | satellite-common | 0:6.7.2-1.el7sat |
| Red Hat satellite 6.7 | satellite-debug-tools | 0:6.7.2-1.el7sat |
| Red Hat satellite 6.7 | tfm-rubygem-fog-vsphere | 0:3.2.1.1-1.el7sat |
| Red Hat satellite 6.7 | tfm-rubygem-foreman-tasks | 0:0.17.5.6-1.el7sat |
| Red Hat satellite 6.7 | tfm-rubygem-foreman_remote_execution | 0:2.0.10.1-1.el7sat |
| Red Hat satellite 6.7 | tfm-rubygem-foreman_remote_execution-cockpit | 0:2.0.10.1-1.el7sat |
| Red Hat satellite 6.7 | tfm-rubygem-foreman_rh_cloud | 0:1.0.9-1.el7sat |
| Red Hat satellite 6.7 | tfm-rubygem-hammer_cli_foreman | 0:0.19.6.5-1.el7sat |
| Red Hat satellite 6.7 | tfm-rubygem-katello | 0:3.14.0.25-1.el7sat |
| Red Hat satellite capsule 6.6 | foreman | 0:1.22.0.39-2.el7sat |
| Red Hat satellite capsule 6.6 | foreman-debug | 0:1.22.0.39-2.el7sat |
| Red Hat satellite capsule 6.6 | satellite | 0:6.6.3-1.el7sat |
| Red Hat satellite capsule 6.6 | satellite-capsule | 0:6.6.3-1.el7sat |
| Red Hat satellite capsule 6.6 | satellite-common | 0:6.6.3-1.el7sat |
| Red Hat satellite capsule 6.6 | satellite-debug-tools | 0:6.6.3-1.el7sat |
| Red Hat satellite capsule 6.7 | foreman | 0:1.24.1.24-1.el7sat |
| Red Hat satellite capsule 6.7 | foreman-debug | 0:1.24.1.24-1.el7sat |
| Red Hat satellite capsule 6.7 | foreman-installer | 1:1.24.1.21-1.el7sat |
| Red Hat satellite capsule 6.7 | foreman-installer-katello | 1:1.24.1.21-1.el7sat |
| Red Hat satellite capsule 6.7 | pulp-rpm | 0:2.21.0.6-1.el7sat |
| Red Hat satellite capsule 6.7 | pulp-rpm-admin-extensions | 0:2.21.0.6-1.el7sat |
| Red Hat satellite capsule 6.7 | pulp-rpm-plugins | 0:2.21.0.6-1.el7sat |
| Red Hat satellite capsule 6.7 | python-pulp-integrity | 0:2.21.0.6-1.el7sat |
| Red Hat satellite capsule 6.7 | python-pulp-rpm-common | 0:2.21.0.6-1.el7sat |
| Red Hat satellite capsule 6.7 | satellite | 0:6.7.2-1.el7sat |
| Red Hat satellite capsule 6.7 | satellite-capsule | 0:6.7.2-1.el7sat |
| Red Hat satellite capsule 6.7 | satellite-common | 0:6.7.2-1.el7sat |
| Red Hat satellite capsule 6.7 | satellite-debug-tools | 0:6.7.2-1.el7sat |
| Ubuntu 18.04 LTS | jackson-databind | no fix |
| Ubuntu 20.04 LTS | jackson-databind | no fix |
| Ubuntu Pro 14.04 LTS | jackson-databind | no fix |
| Ubuntu Pro 16.04 LTS | jackson-databind | 2.4.2-3ubuntu0.1~esm2 |