CVE-2020-9547
Aliases:GHSA-q93h-jc49-78ggDEBIAN-CVE-2020-9547CGA-2458-899m-p689CGA-2pqp-m3hj-4chcCGA-2qg6-cw3p-9prjCGA-2w7m-mwf4-wgqqCGA-32f3-qqf3-44cpCGA-4826-6h5f-3v78CGA-4rc9-9pmc-ggj3CGA-52m9-gj6x-cxfgCGA-5fxh-fjwr-vp74CGA-5xqh-44f8-h2xmCGA-6qp4-3pxp-f7rxCGA-6x77-gh8x-8823CGA-7557-crjq-g9mqCGA-7fjm-jj5h-79fcCGA-7wj8-v4x6-vwvjCGA-83g9-ppph-3hmhCGA-8529-rjv6-cw9vCGA-9834-484j-9w79CGA-9f8f-xwv4-fvhmCGA-9jwc-9ff7-v9c8CGA-cjrq-m44g-j42hCGA-cqpv-859r-5wmfCGA-f4xj-h49w-mfhrCGA-f9rr-mp8j-h6wqCGA-g5cq-x5hh-6vwfCGA-gpc5-f9pc-xcw6CGA-gvjv-vc22-h6crCGA-hqhh-x5c6-26x2CGA-hwvf-mv4c-wgfqCGA-jgvq-h239-5x43CGA-jmv6-mv37-g6fvCGA-mrfp-g5g3-9qhgCGA-p8pf-h6x2-434fCGA-phq9-vhh8-qcmqCGA-q7rw-h6mp-w563CGA-q7rx-2mvp-pj8wCGA-qpmw-29jv-f9vgCGA-r25m-8gh7-37x3CGA-rr4v-48w7-4pgvCGA-w2p8-rphc-cc8hCGA-wqh7-mh72-424gCGA-x55p-4rhv-hrx8CGA-xvm5-7qcm-2x6jCGA-273c-q4c8-7m7pCGA-3gmj-rh63-g467CGA-3wm6-vx6g-w7jgCGA-4jmf-3vvv-qrq8CGA-536p-g5g9-8gcmCGA-5rcp-9f37-77m5CGA-5w8q-jc5p-h9gvCGA-6x8c-cfgh-644gCGA-73q8-94r4-5h7vCGA-83x8-393r-6j6mCGA-9hc3-6c6q-hv64CGA-9v99-c6r8-22r4CGA-ch8f-m67h-9gxmCGA-cvmw-63rq-hmxfCGA-cvrh-qf5j-63fxCGA-f6fq-hp85-wmm8CGA-g48w-62hh-7787CGA-g6hj-hcgg-pvmvCGA-gf94-h788-m4xwCGA-hpf5-p6w9-vg6pCGA-hx22-j8g2-xvx6CGA-j2ff-8cm5-37p9CGA-j478-8286-jccjCGA-jhr9-p97x-mqq2CGA-jjm4-xwfv-2j8cCGA-jwhp-wmwr-235pCGA-mm29-hrwv-pp8vCGA-pfg8-4jpp-m8pcCGA-q65w-5jwg-p83qCGA-q7cx-h97g-79gxCGA-rmg4-xv4v-gq72CGA-wx86-f942-2xgxCGA-2r3x-gh42-w3xwCGA-2rj6-xx45-24vcCGA-3g68-956j-w599CGA-3hhf-pccr-mxqqCGA-3pv8-hwj9-m8ghCGA-3r9p-jxq4-hq5xCGA-4fqr-9f5c-5j43CGA-5h68-r246-h247CGA-5w52-x7wf-3vjmCGA-6jm7-9rpm-5fmvCGA-6x5p-gpxg-45r8CGA-787j-hfwg-g858CGA-79j8-c8cv-mmxcCGA-7ppx-4g22-2vc3CGA-86qx-c2h2-hcv6CGA-8m2f-xc46-p32gCGA-9m2x-rv85-xfggCGA-c45x-qxff-jc98CGA-c47m-v7rp-6wc7CGA-cx36-r7rx-8hp9CGA-fc4r-2g5h-xcq2CGA-gww3-p46v-9qpqCGA-h424-xpm2-vwgfCGA-hjgq-g7j8-4jjjCGA-jwp3-wrq9-q4mvCGA-mcp2-q3gx-q9m9CGA-mfch-54r7-x7cgCGA-pm8j-c4f4-p5qmCGA-ppr5-r8f8-gv49CGA-qhpm-5mqh-6v2hCGA-r4mh-5j43-g7m9CGA-r72h-wjx9-c9gpCGA-rj4r-qjfc-hhhjCGA-rjc6-gwm2-8fx7CGA-v599-cr27-mmx8CGA-vrq9-2wh5-m8prCGA-w5cx-rj77-7xghCGA-w6qc-r652-qfqhCGA-wg2q-rvpp-rvc5CGA-wqj6-747v-gxwpCGA-x9pg-x7g3-mvjxCGA-xf2p-hpc5-v27cCGA-2674-q524-9vf4CGA-2fm4-h955-fx94CGA-3jwx-6q7g-m4vrCGA-43xv-876h-xw4mCGA-539p-73xh-w72mCGA-5qgq-33mj-q7vjCGA-7q4x-pxxg-534hCGA-9g8h-2p8j-hrrjCGA-9vqm-ff9h-mh8fCGA-c4cg-8r6m-8crrCGA-f496-chm8-vjp4CGA-fmpv-3mfp-ccm6CGA-frvw-9g78-8556CGA-h472-wc2c-mf9rCGA-hmv8-2f92-xhxvCGA-j3gm-44h2-f97pCGA-jfwx-fv26-r44cCGA-mc7j-4prh-h493CGA-mqcx-w93r-v752CGA-p2mh-mv7g-c4m6CGA-ppxr-w2xm-wcrrCGA-px8c-884g-cp74CGA-qf3j-h98q-rpcgCGA-qmhw-pv66-4ffxCGA-qmqj-fwg2-fgq4CGA-w7wc-682m-vfwgCGA-wfjc-f5gf-hccvCGA-xw7m-gqw2-4m6w
Advisory lineage Upstream: 0 Downstream: 16
Modified
Published: 02 Mar 2020, 03:59
Last modified:04 Aug 2024, 10:34
Vulnerability Summary
Overall Risk (default)
high
70/100 CVSS Score
9.8 CRITICAL
v3.1 (nvd)
EPSS Score
18.38% MEDIUM
18% probability -24.76%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
02 Mar 2020, 03:59
Published
Vulnerability first disclosed
04 Aug 2024, 10:34
Last Modified
Vulnerability information updated
Description
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
CVSS Metrics
- v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- v2.0•MEDIUM•Score: 6.8AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS Trends
Current EPSS score: 18.38%• Percentile: 97%
Techniques & Countermeasures
- CWE-502•Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Affected Systems
- chainguard•eco-java-gradle-2.10
all
- chainguard•eco-java-gradle-2.11
all
- chainguard•eco-java-gradle-2.12
all
- chainguard•eco-java-gradle-2.13
all
- chainguard•eco-java-gradle-2.14
all
- chainguard•eco-java-gradle-2.14.1
all
- chainguard•eco-java-gradle-2.4
all
- chainguard•eco-java-gradle-2.5
all
- chainguard•eco-java-gradle-2.6
all
- chainguard•eco-java-gradle-2.7
all
- chainguard•eco-java-gradle-2.8
all
- chainguard•eco-java-gradle-2.9
all
- chainguard•eco-java-gradle-3.0
all
- chainguard•eco-java-gradle-3.1
all
- chainguard•eco-java-gradle-3.2
all
- chainguard•eco-java-gradle-3.2.1
all
- chainguard•eco-java-gradle-3.3
all
- chainguard•eco-java-gradle-3.4
all
- chainguard•eco-java-gradle-3.4.1
all
- chainguard•eco-java-gradle-3.5
all
- chainguard•eco-java-gradle-3.5.1
all
- chainguard•eco-java-gradle-4.0
all
- chainguard•eco-java-gradle-4.0.1
all
- chainguard•eco-java-gradle-4.0.2
all
- chainguard•eco-java-gradle-4.1
all
- chainguard•eco-java-gradle-4.10
all
- chainguard•eco-java-gradle-4.10.1
all
- chainguard•eco-java-gradle-4.10.2
all
- chainguard•eco-java-gradle-4.10.3
all
- chainguard•eco-java-gradle-4.2
all
- chainguard•eco-java-gradle-4.2.1
all
- chainguard•eco-java-gradle-4.3
all
- chainguard•eco-java-gradle-4.3.1
all
- chainguard•eco-java-gradle-4.4
all
- chainguard•eco-java-gradle-4.4.1
all
- chainguard•eco-java-gradle-4.5
all
- chainguard•eco-java-gradle-4.5.1
all
- chainguard•eco-java-gradle-4.6
all
- chainguard•eco-java-gradle-4.7
all
- chainguard•eco-java-gradle-4.8
all
- chainguard•eco-java-gradle-4.8.1
all
- chainguard•eco-java-gradle-4.9
all
- chainguard•eco-java-gradle-5.0
all
- chainguard•eco-java-gradle-5.1
all
- chainguard•eco-java-gradle-5.1.1
all
- chainguard•eco-java-gradle-5.2
all
- chainguard•eco-java-gradle-5.2.1
all
- chainguard•eco-java-gradle-5.3
all
- chainguard•eco-java-gradle-5.3.1
all
- chainguard•eco-java-gradle-5.4
all
Showing first 50 affected entries in server-rendered view.
References (44)
- https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html
- https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rd0e958d6d5c5ee16efed73314cd0e445c8dbb4bdcc80fc9d1d6c11fc%40%3Cdev.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3E
- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://lists.apache.org/thread.html/r893a0104e50c1c2559eb9a5812add28ae8c3e5f43712947a9847ec18%40%3Cnotifications.zookeeper.apache.org%3E
- https://github.com/FasterXML/jackson-databind/issues/2634
- https://lists.apache.org/thread.html/redbe4f1e21bf080f637cf9fbec47729750a2f443a919765360337428%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r742ef70d126548dcf7de5be5779355c9d76a9aec71d7a9ef02c6398a%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/ra3e90712f2d59f8cef03fa796f5adf163d32b81fe7b95385f21790e6%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r4accb2e0de9679174efd3d113a059bab71ff3ec53e882790d21c1cc1%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rc0d5d0f72da1ed6fc5e438b1ddb3fa090c73006b55f873cf845375ab%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://security.netapp.com/advisory/ntap-20200904-0006/
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-9547
- https://github.com/FasterXML/jackson-databind/commit/9f4e97019fb0dd836533d0b6198c88787e235ae2
- https://security.netapp.com/advisory/ntap-20200904-0006
- https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E
- https://lists.apache.org/thread.html/redbe4f1e21bf080f637cf9fbec47729750a2f443a919765360337428@%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rd0e958d6d5c5ee16efed73314cd0e445c8dbb4bdcc80fc9d1d6c11fc@%3Cdev.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rc0d5d0f72da1ed6fc5e438b1ddb3fa090c73006b55f873cf845375ab@%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/ra3e90712f2d59f8cef03fa796f5adf163d32b81fe7b95385f21790e6@%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1@%3Cdev.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r893a0104e50c1c2559eb9a5812add28ae8c3e5f43712947a9847ec18@%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r742ef70d126548dcf7de5be5779355c9d76a9aec71d7a9ef02c6398a@%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r4accb2e0de9679174efd3d113a059bab71ff3ec53e882790d21c1cc1@%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd@%3Cissues.zookeeper.apache.org%3E
- https://github.com/FasterXML/jackson-databind
- https://security-tracker.debian.org/tracker/CVE-2020-9547