CVE-2020-24750

Fixed in a distro release EPSS 7%

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.

Published 2020-09-17 · CVE record · OSV

Products: FasterXML jackson-databind, oracle agile_product_lifecycle_management, oracle application_testing_suite, oracle autovue_for_agile_product_lifecycle_management, oracle banking_corporate_lending_process_management, oracle banking_credit_facilities_process_management, oracle banking_liquidity_management, oracle banking_supply_chain_finance, oracle blockchain_platform, oracle communications_calendar_server, oracle communications_contacts_server, oracle communications_diameter_signaling_router, oracle communications_element_manager, oracle communications_instant_messaging_server, oracle communications_messaging_server, oracle communications_offline_mediation_controller, oracle communications_policy_management, oracle communications_pricing_design_center, oracle communications_services_gatekeeper, oracle communications_session_report_manager, oracle communications_session_route_manager, oracle communications_unified_inventory_management, oracle identity_manager_connector, oracle siebel_core-server_framework, oracle siebel_ui_framework, debian_linux

Fixed upstream

Distro releases