CVE-2020-25649

Fixed in a distro release EPSS 18%

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

Published 2020-12-03 · CVE record · OSV

Products: FasterXML jackson-databind, netapp oncommand_api_services, netapp oncommand_workflow_automation, netapp service_level_manager, fedoraproject fedora, quarkus, Apache IoTDB, oracle agile_product_lifecycle_management, oracle agile_product_lifecycle_management_integration_pack, oracle banking_apis, oracle banking_platform, oracle banking_treasury_management, oracle blockchain_platform, oracle coherence, oracle commerce_platform, oracle communications_billing_and_revenue_management, oracle communications_cloud_native_core_unified_data_repository, oracle communications_convergent_charging_controller, oracle communications_evolved_communications_application_server, oracle communications_instant_messaging_server, oracle communications_interactive_session_recorder, oracle communications_network_charging_and_control, oracle communications_offline_mediation_controller, oracle communications_pricing_design_center, oracle communications_services_gatekeeper, oracle communications_unified_inventory_management, oracle goldengate_application_adapters, oracle health_sciences_empirica_signal, oracle insurance_policy_administration, oracle insurance_rules_palette, oracle jd_edwards_enterpriseone_orchestrator, oracle jd_edwards_enterpriseone_tools, oracle primavera_gateway, oracle retail_service_backbone, oracle retail_xstore_point_of_service, oracle sd-wan_edge, oracle utilities_framework, oracle webcenter_portal, oracle communications_messaging_server

Fixed upstream

Distro releases