CVE-2020-25649

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

• fasterxml jackson-databind (>= 2.6.0 < 2.6.7.4) • fasterxml jackson-databind (>= 2.9.0 < 2.9.10.7) • fasterxml jackson-databind (>= 2.10.0 < 2.10.5.1) • netapp oncommand api services • netapp oncommand workflow automation • netapp service level manager • fedoraproject fedora 32 • quarkus quarkus (<= 1.6.1) • apache iotdb (< 0.12.0) • oracle agile product lifecycle management 9.3.6 • oracle agile product lifecycle management integration pack 3.6 • oracle banking apis (>= 18.1 <= 18.3) • oracle banking apis 19.1 • oracle banking apis 19.2 • oracle banking apis 20.1 • oracle banking apis 21.1 • oracle banking platform 2.6.2 • oracle banking platform 2.7.0 • oracle banking platform 2.7.1 • oracle banking platform 2.8.0 • oracle banking platform 2.9.0 • oracle banking platform 2.10.0 • oracle banking treasury management 4.4 • oracle blockchain platform (< 21.1.2) • oracle coherence 12.2.1.4.0 • oracle coherence 14.1.1.0.0 • oracle commerce platform (>= 11.3.0 <= 11.3.2) • oracle commerce platform 11.2.0 • oracle communications billing and revenue management 7.5.0.23.0 • oracle communications billing and revenue management 12.0.0.3.0 • oracle communications cloud native core unified data repository 1.4.0 • oracle communications convergent charging controller 12.0.4.0.0 • oracle communications evolved communications application server 7.1 • oracle communications instant messaging server 10.0.1.5.0 • oracle communications interactive session recorder 6.3 • oracle communications interactive session recorder 6.4 • oracle communications network charging and control 12.0.4.0.0 • oracle communications offline mediation controller 12.0.0.3 • oracle communications pricing design center 12.0.0.4.0 • oracle communications services gatekeeper 7.0 • oracle communications unified inventory management 7.4.1 • oracle goldengate application adapters 19.1.0.0.0 • oracle health sciences empirica signal 9.0 • oracle health sciences empirica signal 9.1 • oracle insurance policy administration (>= 11.1.0 <= 11.3.0) • oracle insurance policy administration 11.0.2 • oracle insurance rules palette (>= 11.1.0 <= 11.3.0) • oracle insurance rules palette 11.0.2 • oracle jd edwards enterpriseone orchestrator (< 9.2.5.3) • oracle jd edwards enterpriseone tools (< 9.2.5.3) • oracle primavera gateway (>= 17.7 <= 17.12) • oracle primavera gateway (>= 17.12.0 <= 17.12.11) • oracle primavera gateway (>= 18.8.0 <= 18.8.11) • oracle primavera gateway (>= 19.12.0 <= 19.12.10) • oracle primavera gateway 20.12.0 • oracle retail service backbone 14.1.3.2 • oracle retail service backbone 15.0.3.1 • oracle retail service backbone 16.0.3 • oracle retail xstore point of service 16.0.6 • oracle retail xstore point of service 17.0.4 … and 13 more