CVE-2020-35491

Fixed in a distro release EPSS 8%

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.

Published 2020-12-17 · CVE record · OSV

Products: FasterXML jackson-databind, netapp service_level_manager, debian_linux, oracle agile_product_lifecycle_management, oracle application_testing_suite, oracle autovue_for_agile_product_lifecycle_management, oracle banking_platform, oracle banking_treasury_management, oracle banking_virtual_account_management, oracle blockchain_platform, oracle communications_cloud_native_core_policy, oracle communications_cloud_native_core_unified_data_repository, oracle communications_diameter_signaling_route, oracle communications_evolved_communications_application_server, oracle communications_instant_messaging_server, oracle communications_offline_mediation_controller, oracle communications_pricing_design_center, oracle communications_services_gatekeeper, oracle communications_unified_inventory_management, oracle documaker, oracle insurance_policy_administration_j2ee, oracle retail_customer_management_and_segmentation_foundation, oracle retail_merchandising_system, oracle retail_xstore_point_of_service, oracle sd-wan_edge, oracle webcenter_portal

Fixed upstream

Distro releases