CVE-2020-8840

Aliases:GHSA-4w82-r329-3q67DEBIAN-CVE-2020-8840CGA-3qc5-53h8-rrqvCGA-3qfm-92vj-33mfCGA-3w5f-vmff-cr4xCGA-47wm-x228-6hr9CGA-4fpc-3hrm-g74wCGA-4x43-98p3-7fmrCGA-56w4-8m42-76frCGA-5g97-r2h6-7c48CGA-5pjj-f49x-jgg7CGA-68mf-mcvq-5wggCGA-75rw-vm33-4p84CGA-77vx-fm3m-h2xjCGA-7xpw-3p7f-whp4CGA-8m8q-pr56-4g7gCGA-8ww3-v874-p34fCGA-949j-3jc6-5r57CGA-9v63-c42w-565hCGA-c9wx-7mpr-mhr5CGA-f9fq-vphm-5r36CGA-fjmq-rxgc-2wcpCGA-g3hr-h76q-p48pCGA-hvq6-76r6-9w25CGA-mm2q-94vc-vqjxCGA-mppg-xcmq-gcx2CGA-mr57-8hm7-r2ffCGA-mx25-2qx9-ww6jCGA-pq5w-qmcp-v8j9CGA-q79q-c8xc-m7xqCGA-qf7g-5hmg-hpcgCGA-qp73-2qm3-j9pgCGA-qx5h-33x4-m6x7CGA-r2c7-682g-r487CGA-r7xg-3r3p-pjf9CGA-rf53-f2cm-3qx6CGA-rm3f-h22w-g3vhCGA-rpgr-2wmq-g8vpCGA-v5r3-whrm-5pm5CGA-vpqv-qjgx-f6xqCGA-w5fm-px4p-5vw6CGA-wpj5-8hjr-m2pwCGA-wq75-73v4-hjcmCGA-x7mc-vjr8-q9r4CGA-225r-8hmf-v945CGA-23jp-6qq5-3773CGA-4fq7-6838-xh8gCGA-54rg-j7pj-2rp7CGA-5h24-xcq2-28rfCGA-6223-6g5j-5c42CGA-6x2r-r97j-7293CGA-729q-884v-229gCGA-7h98-6cvq-q23xCGA-82qh-5cx4-mc42CGA-98cx-7fwv-8868CGA-9qgf-p35v-w7gjCGA-c3pw-5w3r-7qpwCGA-cr5c-wh7h-2cf4CGA-fv8v-mmr2-48j4CGA-g6pj-c5f9-m6qhCGA-hv58-q76x-535mCGA-jr74-26vv-gfhjCGA-m67r-fcgj-5fpvCGA-m988-84pq-hxpvCGA-mrmf-qcw3-75grCGA-pxm2-r697-frwxCGA-qfqj-mfpc-9g7qCGA-r667-7g3c-6gpmCGA-rrjm-pgfv-pxfmCGA-vvqw-mp6v-cwx7CGA-wpvx-7w76-gm8jCGA-wwh5-mq9w-5q69CGA-2m75-886m-6gf9CGA-2pm7-x6rj-xpgjCGA-3qrv-48h8-g7m8CGA-3xg6-433r-374mCGA-44hr-c3v8-hwq9CGA-46hp-wmf9-3q42CGA-529x-f723-h6jwCGA-55r8-v357-h926CGA-58w8-fh82-wmhfCGA-7rvq-jm3q-pmf5CGA-7vhf-4f5f-rjr7CGA-8f3q-8m5p-2gx7CGA-8q7p-qwfj-gpw8CGA-8q95-qhrx-rf8pCGA-8vwr-vc3q-28gpCGA-9h79-v6p7-jrc5CGA-9m22-vv6j-q5gvCGA-c6m7-fpwf-7p9rCGA-cvww-qjc2-q928CGA-f72r-qwj8-g822CGA-f7wc-97rv-9rj2CGA-fmcm-q867-2q8gCGA-g2mw-m8vc-v635CGA-g65m-gj52-w4qvCGA-g9jc-mvjh-v7hgCGA-gp93-6q8g-w6pmCGA-h4vp-g496-mxfvCGA-h723-qj7v-f4jcCGA-hv2p-7mfr-xfg9CGA-jp2r-9m77-79x7CGA-jv5g-v2rm-qgr6CGA-mqw9-jmwm-w826CGA-p3cr-w4x4-vw73CGA-q85x-xw6j-5fc6CGA-q875-7392-wg3mCGA-qp4j-5vq5-8jhxCGA-qwr7-6wx7-2829CGA-rv48-q6r6-w76hCGA-w8mf-67qf-r328CGA-wc74-64pc-g3vmCGA-wx42-qph3-jv2vCGA-xqp8-56px-rvh7CGA-2jch-5fmr-v627CGA-3w9v-3vxv-7387CGA-3x9j-mmx4-9q58CGA-4x43-c89v-vphqCGA-7fpf-j55v-pw62CGA-7j34-h35r-55q3CGA-7mhv-ppcw-3h6qCGA-967m-hff2-g5pjCGA-97xp-423h-qvgjCGA-9m2w-vrrv-6p73CGA-cwm3-vwp8-rvr8CGA-cxc8-m5pp-j94qCGA-f755-p4wr-h685CGA-f96q-7gpr-r6cjCGA-ff44-632c-749pCGA-g8fr-hxpv-6cxhCGA-hq4x-gr4m-47v3CGA-jf9p-43f8-vc8fCGA-jqmw-85g2-732pCGA-m47j-q923-c3jcCGA-mqgf-9rpc-8xc7CGA-q9j7-3r3f-qcqvCGA-qrg8-g6p9-w433CGA-v357-fcc7-625cCGA-v64p-48fv-7p9rCGA-v668-56f2-q9vxCGA-v826-qj77-x37gCGA-v99r-p4fg-prp8CGA-vj5v-vvrp-h5xpCGA-ww84-xr7j-jcphCGA-x8rx-8vxc-xph2CGA-xx8r-pqf5-j7cr
Advisory lineage Upstream: 0 Downstream: 16
Modified
Published: 10 Feb 2020, 19:41
Last modified:04 Aug 2024, 10:12

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (nvd)
EPSS Score
26.59% HIGH
27% probability +18.42%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

10 Feb 2020, 19:41
Published
Vulnerability first disclosed
04 Aug 2024, 10:12
Last Modified
Vulnerability information updated

Description

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

CVSS Metrics

  • v3.1CRITICALScore: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v2.0HIGHScore: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 26.59% Percentile: 98%

Techniques & Countermeasures

  • CWE-502Deserialization of Untrusted Data

    The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected Systems

  • chainguardeco-java-gradle-2.10

    all

  • chainguardeco-java-gradle-2.11

    all

  • chainguardeco-java-gradle-2.12

    all

  • chainguardeco-java-gradle-2.13

    all

  • chainguardeco-java-gradle-2.14

    all

  • chainguardeco-java-gradle-2.14.1

    all

  • chainguardeco-java-gradle-2.4

    all

  • chainguardeco-java-gradle-2.5

    all

  • chainguardeco-java-gradle-2.6

    all

  • chainguardeco-java-gradle-2.7

    all

  • chainguardeco-java-gradle-2.8

    all

  • chainguardeco-java-gradle-2.9

    all

  • chainguardeco-java-gradle-3.0

    all

  • chainguardeco-java-gradle-3.1

    all

  • chainguardeco-java-gradle-3.2

    all

  • chainguardeco-java-gradle-3.2.1

    all

  • chainguardeco-java-gradle-3.3

    all

  • chainguardeco-java-gradle-3.4

    all

  • chainguardeco-java-gradle-3.4.1

    all

  • chainguardeco-java-gradle-3.5

    all

  • chainguardeco-java-gradle-3.5.1

    all

  • chainguardeco-java-gradle-4.0

    all

  • chainguardeco-java-gradle-4.0.1

    all

  • chainguardeco-java-gradle-4.0.2

    all

  • chainguardeco-java-gradle-4.1

    all

  • chainguardeco-java-gradle-4.10

    all

  • chainguardeco-java-gradle-4.10.1

    all

  • chainguardeco-java-gradle-4.10.2

    all

  • chainguardeco-java-gradle-4.10.3

    all

  • chainguardeco-java-gradle-4.2

    all

  • chainguardeco-java-gradle-4.2.1

    all

  • chainguardeco-java-gradle-4.3

    all

  • chainguardeco-java-gradle-4.3.1

    all

  • chainguardeco-java-gradle-4.4

    all

  • chainguardeco-java-gradle-4.4.1

    all

  • chainguardeco-java-gradle-4.5

    all

  • chainguardeco-java-gradle-4.5.1

    all

  • chainguardeco-java-gradle-4.6

    all

  • chainguardeco-java-gradle-4.7

    all

  • chainguardeco-java-gradle-4.8

    all

  • chainguardeco-java-gradle-4.8.1

    all

  • chainguardeco-java-gradle-4.9

    all

  • chainguardeco-java-gradle-5.0

    all

  • chainguardeco-java-gradle-5.1

    all

  • chainguardeco-java-gradle-5.1.1

    all

  • chainguardeco-java-gradle-5.2

    all

  • chainguardeco-java-gradle-5.2.1

    all

  • chainguardeco-java-gradle-5.3

    all

  • chainguardeco-java-gradle-5.3.1

    all

  • chainguardeco-java-gradle-5.4

    all

Showing first 50 affected entries in server-rendered view.

References (89)