CVE-2020-9548
Aliases:GHSA-p43x-xfjf-5jhrDEBIAN-CVE-2020-9548CGA-2564-qwmx-q7fmCGA-2746-j88x-7v55CGA-29vw-p9g7-6m54CGA-2fg6-7jg3-gx35CGA-34pw-vjr8-q9f4CGA-4737-jxfg-qjgfCGA-483c-c757-5558CGA-5m96-xhc5-cv9fCGA-5p2h-4jv7-3m3hCGA-6c2p-8443-xqv4CGA-6vfc-p9ww-fhxrCGA-6wvr-j86j-633vCGA-8xh9-pqxw-g6wpCGA-92p5-99wx-7fpgCGA-9g34-332x-jwx4CGA-c29r-mp32-fv9gCGA-c8jp-7j4c-v4wmCGA-cvp8-pp77-pr2rCGA-ffjr-xvc2-prg9CGA-g2q5-h5q3-2p8xCGA-gcqh-4qx5-mfm7CGA-gcww-pq29-qjm2CGA-grhf-5jj4-cq88CGA-hf26-cpgw-5769CGA-hjrw-jhwq-33mqCGA-jw5c-mj49-f7v7CGA-m488-3pr7-4pjqCGA-pcwr-rxfw-2258CGA-r957-57rr-qmj2CGA-rc49-xjff-2hgvCGA-rwch-ccmj-9xfhCGA-rwvc-87qf-qv4vCGA-v228-jc92-79vxCGA-v344-xq7c-j3x6CGA-v6gp-wrhp-fq2hCGA-w2gw-mw2q-xm42CGA-w42m-f9xh-67jjCGA-wf36-ch29-ghwpCGA-wm7c-r4jh-x9jmCGA-wvj3-gff9-qx62CGA-x525-3qg8-64hjCGA-x9jq-r97x-m7p7CGA-xg56-rrr9-rh4hCGA-25wq-pcxw-6c2cCGA-2mc3-5m54-v44mCGA-3g9g-rj77-j2wrCGA-3mfm-26pc-m855CGA-5897-937f-8rcvCGA-67f5-rqjm-f6cpCGA-6x9v-qv68-2fhvCGA-7rf9-mq8x-56f8CGA-8hqj-6wj7-9gxgCGA-8hvx-f7fw-jg97CGA-8qhx-7f2j-5cg6CGA-9p2p-vh3p-j632CGA-chr9-4fgf-27hpCGA-g62m-mr36-q4rqCGA-hp8q-r8v2-67jcCGA-hpjf-fmrj-xp32CGA-j4jq-x5q6-p8jjCGA-p6gf-477c-w73xCGA-qx74-22mc-6fpfCGA-r82c-rjcg-2v94CGA-vq69-j246-85qjCGA-w6m4-52mf-4r7fCGA-xwg7-w294-w7x8CGA-2cqf-j3g2-r63pCGA-2cx5-w54j-g3w6CGA-2wqw-56jp-599xCGA-36j5-6447-3fv4CGA-3hj5-pvvv-gm44CGA-44h4-r7ph-9whqCGA-496p-j3fj-w6p8CGA-4qrm-rjfp-9p7mCGA-688x-852g-4jccCGA-6rfc-7xmm-qgvpCGA-73p6-65g7-5w4jCGA-8wf3-8vp5-r3jrCGA-97p5-m84g-2rw9CGA-9xpq-h7w2-9ww8CGA-c7f6-qjqr-p6vqCGA-chpw-gp3c-p7hqCGA-cr37-hwq4-4r8vCGA-f855-w4q4-pc6fCGA-g4hv-phxp-q766CGA-h5mj-5qmv-9f6fCGA-hwwq-5747-324jCGA-j268-fmqm-3qr8CGA-jgcx-92gm-jgm9CGA-jxgm-q4fr-m3h3CGA-p8v9-qw3c-q7rxCGA-pm5v-v67h-3pvfCGA-q2pc-4gh9-mmcvCGA-q3rr-2qjp-6g32CGA-qh36-f3h8-42cwCGA-r867-95f5-8hrhCGA-rgrr-v6pf-r43vCGA-rh8q-9p55-qhgxCGA-rm3q-r8ph-w573CGA-rwhv-9486-76cmCGA-vgx5-85jv-q4frCGA-vh6x-5qg7-f4cjCGA-wr86-r48j-935fCGA-wvh7-w5wf-x2fcCGA-x2xq-7327-2jjxCGA-x482-8r79-5c85CGA-xc2j-8cjw-9v3hCGA-xrp6-wp8h-2gw7CGA-3433-h67m-87qpCGA-3g34-fgmg-2994CGA-4rfj-74fj-m262CGA-4vx6-3p86-gc92CGA-56fp-84h4-jc6jCGA-58fr-q5vv-f87vCGA-5jjr-8g44-7jg4CGA-5qf5-hc8r-vj2rCGA-5wj5-pxr5-rff9CGA-5xh5-hj2v-rcp5CGA-66wf-j3ww-gc95CGA-6wpj-cj9p-9j9vCGA-6xx2-88v7-cwgvCGA-73h7-74g8-5r8hCGA-89fj-8v38-j973CGA-9mv2-g8w8-5ccxCGA-c7wp-ghxx-34xwCGA-ccmw-28gx-xxwfCGA-chw5-h7mm-286qCGA-chxh-3vgv-3j4fCGA-f56j-697p-8p7gCGA-fc2j-36x3-g9rhCGA-fhjq-m2gv-hg59CGA-fhpq-vrm5-gjh3CGA-g3fw-jp68-m33pCGA-grq2-2h6x-89cxCGA-gwmr-vmf5-9mxjCGA-j4p2-grh3-2fwcCGA-m9vm-g8w4-fmpwCGA-p8v9-qxpq-c9jwCGA-pfvw-357m-9xvvCGA-rwh2-rrr3-7275CGA-rxg3-xcjf-jm6gCGA-v55p-3w6q-hq3gCGA-v67c-gxpp-h73xCGA-vf5r-xqhp-w38rCGA-xr6c-2m5w-v28h
Advisory lineage Upstream: 0 Downstream: 16
Modified
Published: 02 Mar 2020, 03:58
Last modified:04 Aug 2024, 10:34
Vulnerability Summary
Overall Risk (default)
high
70/100 CVSS Score
9.8 CRITICAL
v3.1 (nvd)
EPSS Score
18.34% MEDIUM
18% probability -43.67%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
02 Mar 2020, 03:58
Published
Vulnerability first disclosed
04 Aug 2024, 10:34
Last Modified
Vulnerability information updated
Description
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
CVSS Metrics
- v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- v2.0•MEDIUM•Score: 6.8AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS Trends
Current EPSS score: 18.34%• Percentile: 97%
Techniques & Countermeasures
- CWE-502•Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Affected Systems
- chainguard•eco-java-gradle-2.10
all
- chainguard•eco-java-gradle-2.11
all
- chainguard•eco-java-gradle-2.12
all
- chainguard•eco-java-gradle-2.13
all
- chainguard•eco-java-gradle-2.14
all
- chainguard•eco-java-gradle-2.14.1
all
- chainguard•eco-java-gradle-2.4
all
- chainguard•eco-java-gradle-2.5
all
- chainguard•eco-java-gradle-2.6
all
- chainguard•eco-java-gradle-2.7
all
- chainguard•eco-java-gradle-2.8
all
- chainguard•eco-java-gradle-2.9
all
- chainguard•eco-java-gradle-3.0
all
- chainguard•eco-java-gradle-3.1
all
- chainguard•eco-java-gradle-3.2
all
- chainguard•eco-java-gradle-3.2.1
all
- chainguard•eco-java-gradle-3.3
all
- chainguard•eco-java-gradle-3.4
all
- chainguard•eco-java-gradle-3.4.1
all
- chainguard•eco-java-gradle-3.5
all
- chainguard•eco-java-gradle-3.5.1
all
- chainguard•eco-java-gradle-4.0
all
- chainguard•eco-java-gradle-4.0.1
all
- chainguard•eco-java-gradle-4.0.2
all
- chainguard•eco-java-gradle-4.1
all
- chainguard•eco-java-gradle-4.10
all
- chainguard•eco-java-gradle-4.10.1
all
- chainguard•eco-java-gradle-4.10.2
all
- chainguard•eco-java-gradle-4.10.3
all
- chainguard•eco-java-gradle-4.2
all
- chainguard•eco-java-gradle-4.2.1
all
- chainguard•eco-java-gradle-4.3
all
- chainguard•eco-java-gradle-4.3.1
all
- chainguard•eco-java-gradle-4.4
all
- chainguard•eco-java-gradle-4.4.1
all
- chainguard•eco-java-gradle-4.5
all
- chainguard•eco-java-gradle-4.5.1
all
- chainguard•eco-java-gradle-4.6
all
- chainguard•eco-java-gradle-4.7
all
- chainguard•eco-java-gradle-4.8
all
- chainguard•eco-java-gradle-4.8.1
all
- chainguard•eco-java-gradle-4.9
all
- chainguard•eco-java-gradle-5.0
all
- chainguard•eco-java-gradle-5.1
all
- chainguard•eco-java-gradle-5.1.1
all
- chainguard•eco-java-gradle-5.2
all
- chainguard•eco-java-gradle-5.2.1
all
- chainguard•eco-java-gradle-5.3
all
- chainguard•eco-java-gradle-5.3.1
all
- chainguard•eco-java-gradle-5.4
all
Showing first 50 affected entries in server-rendered view.
References (31)
- https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html
- https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3E
- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://github.com/FasterXML/jackson-databind/issues/2634
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://security.netapp.com/advisory/ntap-20200904-0006/
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-9548
- https://github.com/FasterXML/jackson-databind/commit/1e64db6a2fad331f96c7363fda3bc5f3dffa25bb
- https://github.com/FasterXML/jackson-databind/commit/9f4e97019fb0dd836533d0b6198c88787e235ae2
- https://security.netapp.com/advisory/ntap-20200904-0006
- https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E
- https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1@%3Cdev.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd@%3Cissues.zookeeper.apache.org%3E
- https://github.com/FasterXML/jackson-databind
- https://security-tracker.debian.org/tracker/CVE-2020-9548