CVE-2020-14062

Aliases:GHSA-c265-37vj-cwccDEBIAN-CVE-2020-14062CGA-24vc-9f23-78p2CGA-c584-7cxp-fh5qCGA-ffm4-6vh6-fhm6CGA-fxw6-m9rm-96wvCGA-ghqf-2g8v-p9whCGA-gmhq-9jvf-c474CGA-gpj2-r6xp-fr8xCGA-jhhj-mcj9-xhxgCGA-prwr-rjhw-p47pCGA-qxfr-p89r-p856CGA-rxmf-vm5g-cfq4CGA-v495-5vxm-g4fcCGA-x428-cpqp-93xjCGA-xv8w-7hmq-vx6xCGA-4h4v-466g-57rvCGA-788w-xvgw-m5wgCGA-fc4c-99g2-v73jCGA-h6vf-rrm2-9x45CGA-r5p6-mq4m-78prCGA-w829-2x2c-4hmqCGA-37wq-pr5x-v69xCGA-3vfj-28vw-mvx3CGA-3xcp-c36p-qqfqCGA-5gxp-2vch-mhfrCGA-5x83-qc8x-3qg9CGA-6wvj-5j93-rf64CGA-9cj8-x557-cwmfCGA-9jrq-j76c-xghrCGA-c7h6-x2q2-g9g8CGA-h37c-qxxm-5x6vCGA-ph79-4f6m-j685CGA-q6fp-whx8-hw7gCGA-r964-7rw6-mj7vCGA-v2mf-232c-phwvCGA-vh8r-mf93-c2hmCGA-vq3w-4c6c-hgrqCGA-whfj-5g7h-9wj7CGA-x34r-5pc4-mgr7CGA-xhp6-mmqm-mfq7CGA-xm3f-x47g-8g5xCGA-2w97-3mq9-8hpmCGA-3qjc-xg6r-w9gxCGA-3wff-r58q-3jh6CGA-4354-r56f-hjgpCGA-6vpx-c8pj-qfm6CGA-7pwc-mwmc-rpvfCGA-8vj5-c3wr-f93hCGA-f3fr-4q6x-rw36CGA-g6gj-w9mm-cghwCGA-g9p6-jfgc-f9cxCGA-jq5c-rjw8-j2jcCGA-mh7v-6wf6-p4q8CGA-q4m5-vfjq-2ffpCGA-vmgf-4xq6-mh7jCGA-vrgv-9ww7-4vpqCGA-wfc2-r4pw-vf6c
Advisory lineage Upstream: 0 Downstream: 8
Analyzed
Published: 14 Jun 2020, 19:42
Last modified:04 Aug 2024, 12:32

Vulnerability Summary

Overall Risk (default)
medium
34/100
CVSS Score
8.1 HIGH
v3.1 (nvd)
EPSS Score
8.07% LOW
8% probability +0.37%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

14 Jun 2020, 19:42
Published
Vulnerability first disclosed
04 Aug 2024, 12:32
Last Modified
Vulnerability information updated

Description

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2).

CVSS Metrics

  • v3.1•HIGH•Score: 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v2.0•MEDIUM•Score: 6.8AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 8.07%• Percentile: 95%

Techniques & Countermeasures

  • CWE-502•Deserialization of Untrusted Data

    The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected Systems

  • chainguard•eco-java-gradle-4.10

    all

  • chainguard•eco-java-gradle-4.10.1

    all

  • chainguard•eco-java-gradle-4.10.2

    all

  • chainguard•eco-java-gradle-4.10.3

    all

  • chainguard•eco-java-gradle-4.9

    all

  • chainguard•eco-java-gradle-5.0

    all

  • chainguard•eco-java-gradle-5.1

    all

  • chainguard•eco-java-gradle-5.1.1

    all

  • chainguard•eco-java-gradle-5.2

    all

  • chainguard•eco-java-gradle-5.2.1

    all

  • chainguard•eco-java-gradle-5.3

    all

  • chainguard•eco-java-gradle-5.3.1

    all

  • chainguard•eco-java-gradle-5.4

    all

  • chainguard•eco-java-gradle-5.4.1

    all

  • chainguard•eco-java-gradle-5.5

    all

  • chainguard•eco-java-gradle-5.5.1

    all

  • chainguard•eco-java-gradle-5.6

    all

  • chainguard•eco-java-gradle-5.6.1

    all

  • chainguard•eco-java-gradle-5.6.2

    all

  • chainguard•eco-java-gradle-5.6.3

    all

  • chainguard•eco-java-gradle-5.6.4

    all

  • chainguard•eco-java-gradle-6.0

    all

  • chainguard•eco-java-gradle-6.0.1

    all

  • chainguard•eco-java-gradle-6.1

    all

  • chainguard•eco-java-gradle-6.1.1

    all

  • chainguard•eco-java-gradle-6.2

    all

  • chainguard•eco-java-gradle-6.2.1

    all

  • chainguard•eco-java-gradle-6.2.2

    all

  • debian•jackson-databind

    < 2.11.1-1 | < 2.11.1-1 | < 2.11.1-1 | < 2.11.1-1

  • debian•debian_linux

    8.0

  • fasterxml•jackson-databind

    ≥ 2.9.0, < 2.9.10.5 | ≥ 2.0.0, < 2.9.10.5

  • com.fasterxml.jackson.core•jackson-databind

    ≥ 2.9.0, < 2.9.10.5

  • netapp•active_iq_unified_manager

    ≥ 7.3 | ≥ 9.5

  • netapp•steelstore_cloud_integrated_storage

    na

  • oracle•agile_plm

    9.3.6

  • oracle•agile_product_lifecycle_management

    9.3.6

  • oracle•banking_digital_experience

    18.1 | 18.2 | 18.3 | 19.1 | 19.2 | 20.1

  • oracle•communications_calendar_server

    8.0.0.4.0

  • oracle•communications_contacts_server

    8.0.0.5.0

  • oracle•communications_diameter_signaling_router

    ≥ 8.0.0, ≤ 8.2.2

  • oracle•communications_element_manager

    ≥ 8.2.0, ≤ 8.2.2

  • oracle•communications_evolved_communications_application_server

    7.1

  • oracle•communications_session_report_manager

    ≥ 8.2.0, ≤ 8.2.2

  • oracle•communications_session_route_manager

    ≥ 8.2.0, ≤ 8.2.2

References (17)