CVE-2020-9546

Aliases:GHSA-5p34-5m6p-p58gDEBIAN-CVE-2020-9546CGA-3jjj-q23m-928qCGA-984j-jw6w-hrf4CGA-9f5j-rmcv-q6rvCGA-c28p-fmr9-vmfhCGA-g5x2-723g-ph63CGA-hf3p-7wvp-p8rpCGA-jw59-vvpv-9fq8CGA-p9jq-2xgq-hrhqCGA-pf8f-3646-mjp6CGA-pm4f-p4rq-v6v9CGA-qfpg-c9rr-gvqxCGA-rv4c-chhp-2wm8CGA-v7h8-pxxr-qm3wCGA-wm27-r5xw-5hmwCGA-39vh-2hm7-5pc7CGA-3hvj-9cg2-rw55CGA-5rqv-462x-9j69CGA-5w6m-wgfr-fg45CGA-9xv5-w8rj-95w2CGA-cjgm-97v7-g7r7CGA-gv78-p9gh-2xx9CGA-h8m4-2j6p-78p4CGA-r67q-pgfc-wvf8CGA-xx7c-8c82-ppg8CGA-36rg-h7qp-rr4rCGA-3q3w-f8v3-j8jfCGA-56q4-q627-g3q4CGA-6m7h-c6wp-rm79CGA-6wgv-h345-hr82CGA-73vq-22vj-5jw2CGA-8jgv-mgrf-hq2qCGA-9mw2-6rjx-q2mmCGA-c26c-9j43-9mqmCGA-cqf7-x6p5-j7jqCGA-gq5q-wgp7-wp35CGA-mc72-7ccw-hp37CGA-phqj-wh2c-3qrcCGA-rfjh-9435-wggpCGA-rjq5-48c5-2mh7CGA-w8hx-5j2h-x7jhCGA-wcr9-q6v6-74gwCGA-wh8h-v2w3-2g5qCGA-x9x4-m845-6fwfCGA-xwmx-2mcf-fhjxCGA-6hxg-96hq-vccjCGA-7pgm-7qc2-w623CGA-8v6p-36cc-jr7qCGA-9vrv-g53w-q2g9CGA-j4q8-pq4r-hjmxCGA-p778-8576-7439CGA-pfxr-q42f-p8q3CGA-rxww-wpc6-rf8rCGA-v52g-xggq-3p4fCGA-vfw6-2jfr-q359CGA-w94h-q3f2-8xp6CGA-wxfm-jch3-vhwh
Advisory lineage Upstream: 0 Downstream: 16
Analyzed
Published: 02 Mar 2020, 03:59
Last modified:04 Aug 2024, 10:34

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (nvd)
EPSS Score
4.61% LOW
5% probability +2.29%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

02 Mar 2020, 03:59
Published
Vulnerability first disclosed
04 Aug 2024, 10:34
Last Modified
Vulnerability information updated

Description

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v2.0•MEDIUM•Score: 6.8AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 4.61%• Percentile: 91%

Techniques & Countermeasures

  • CWE-502•Deserialization of Untrusted Data

    The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected Systems

  • chainguard•eco-java-gradle-4.10

    all

  • chainguard•eco-java-gradle-4.10.1

    all

  • chainguard•eco-java-gradle-4.10.2

    all

  • chainguard•eco-java-gradle-4.10.3

    all

  • chainguard•eco-java-gradle-4.9

    all

  • chainguard•eco-java-gradle-5.0

    all

  • chainguard•eco-java-gradle-5.1

    all

  • chainguard•eco-java-gradle-5.1.1

    all

  • chainguard•eco-java-gradle-5.2

    all

  • chainguard•eco-java-gradle-5.2.1

    all

  • chainguard•eco-java-gradle-5.3

    all

  • chainguard•eco-java-gradle-5.3.1

    all

  • chainguard•eco-java-gradle-5.4

    all

  • chainguard•eco-java-gradle-5.4.1

    all

  • chainguard•eco-java-gradle-5.5

    all

  • chainguard•eco-java-gradle-5.5.1

    all

  • chainguard•eco-java-gradle-5.6

    all

  • chainguard•eco-java-gradle-5.6.1

    all

  • chainguard•eco-java-gradle-5.6.2

    all

  • chainguard•eco-java-gradle-5.6.3

    all

  • chainguard•eco-java-gradle-5.6.4

    all

  • chainguard•eco-java-gradle-6.0

    all

  • chainguard•eco-java-gradle-6.0.1

    all

  • chainguard•eco-java-gradle-6.1

    all

  • chainguard•eco-java-gradle-6.1.1

    all

  • chainguard•eco-java-gradle-6.2

    all

  • chainguard•eco-java-gradle-6.2.1

    all

  • chainguard•eco-java-gradle-6.2.2

    all

  • debian•jackson-databind

    < 2.11.1-1 | < 2.11.1-1 | < 2.11.1-1 | < 2.11.1-1

  • debian•debian_linux

    8.0

  • fasterxml•jackson-databind

    ≥ 2.7.0, < 2.7.9.7 | ≥ 2.0.0, < 2.7.9.7 | ≥ 2.8.0, < 2.8.11.6 | ≥ 2.9.0, < 2.9.10.4

  • com.fasterxml.jackson.core•jackson-databind

    ≥ 2.9.0, < 2.9.10.4

  • netapp•active_iq_unified_manager

    ≥ 7.3 | ≥ 9.5

  • oracle•agile_plm

    9.3.6

  • oracle•agile_product_lifecycle_management

    9.3.6

  • oracle•autovue_for_agile_product_lifecycle_management

    21.0.2

  • oracle•banking_digital_experience

    18.1 | 18.2 | 18.3 | 19.1 | 19.2 | 20.1

  • oracle•banking_platform

    ≥ 2.4.0, ≤ 2.9.0

  • oracle•communications_calendar_server

    8.0.0.4.0

  • oracle•communications_contacts_server

    8.0.0.4.0 | 8.0.0.5.0

  • oracle•communications_diameter_signaling_router

    ≥ 8.0.0, ≤ 8.2.2

  • oracle•communications_element_manager

    ≥ 8.2.0, ≤ 8.2.2

  • oracle•communications_evolved_communications_application_server

    7.1

  • oracle•communications_instant_messaging_server

    10.0.1.4.0

  • oracle•communications_network_charging_and_control

    ≥ 12.0.0, ≤ 12.0.3 | 6.0.1

  • oracle•communications_session_report_manager

    ≥ 8.2.0, ≤ 8.2.2

  • oracle•communications_session_route_manager

    ≥ 8.2.0, ≤ 8.2.2

  • oracle•enterprise_manager_base_platform

    13.3.0.0 | 13.4.0.0

  • oracle•financial_services_analytical_applications_infrastructure

    ≥ 8.0.6, ≤ 8.1.0

  • oracle•financial_services_institutional_performance_analytics

    8.0.6 | 8.0.7 | 8.1.0 | 8.7.0

Showing first 50 affected entries in server-rendered view.

References (31)