CVEvulnerability

CVE-2020-9546

9.8 CRITICAL Published 2020-03-02 Modified 2026-10-07 Official page ↗
Status
Modified
Published
2020-03-02
Last modified
2026-10-07
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-502

Description

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

Affected configurations

• fasterxml jackson-databind (>= 2.0.0 < 2.7.9.7) • fasterxml jackson-databind (>= 2.8.0 < 2.8.11.6) • fasterxml jackson-databind (>= 2.9.0 < 2.9.10.4) • netapp active iq unified manager (>= 7.3) • netapp active iq unified manager (>= 9.5) • debian debian linux 8.0 • oracle agile product lifecycle management 9.3.6 • oracle autovue for agile product lifecycle management 21.0.2 • oracle banking digital experience 18.1 • oracle banking digital experience 18.2 • oracle banking digital experience 18.3 • oracle banking digital experience 19.1 • oracle banking digital experience 19.2 • oracle banking digital experience 20.1 • oracle banking platform (>= 2.4.0 <= 2.9.0) • oracle communications calendar server 8.0.0.4.0 • oracle communications contacts server 8.0.0.4.0 • oracle communications contacts server 8.0.0.5.0 • oracle communications diameter signaling router (>= 8.0.0 <= 8.2.2) • oracle communications element manager (>= 8.2.0 <= 8.2.2) • oracle communications evolved communications application server 7.1 • oracle communications instant messaging server 10.0.1.4.0 • oracle communications network charging and control (>= 12.0.0 <= 12.0.3) • oracle communications network charging and control 6.0.1 • oracle communications session report manager (>= 8.2.0 <= 8.2.2) • oracle communications session route manager (>= 8.2.0 <= 8.2.2) • oracle enterprise manager base platform 13.3.0.0 • oracle enterprise manager base platform 13.4.0.0 • oracle financial services analytical applications infrastructure (>= 8.0.6 <= 8.1.0) • oracle financial services institutional performance analytics 8.0.6 • oracle financial services institutional performance analytics 8.0.7 • oracle financial services institutional performance analytics 8.1.0 • oracle financial services institutional performance analytics 8.7.0 • oracle financial services price creation and discovery 8.0.6 • oracle financial services price creation and discovery 8.0.7 • oracle financial services retail customer analytics 8.0.6 • oracle global lifecycle management opatch (< 12.2.0.1.20) • oracle insurance policy administration j2ee 11.0.2.25 • oracle insurance policy administration j2ee 11.1.0.15 • oracle jd edwards enterpriseone orchestrator (< 9.2.4.2) • oracle jd edwards enterpriseone tools (< 9.2.4.2) • oracle primavera unifier (>= 17.7 <= 17.12) • oracle primavera unifier 16.1 • oracle primavera unifier 16.2 • oracle primavera unifier 18.8 • oracle primavera unifier 19.12 • oracle retail merchandising system 15.0 • oracle retail sales audit 14.1 • oracle retail service backbone 14.1 • oracle retail service backbone 15.0 • oracle retail service backbone 16.0 • oracle retail xstore point of service 15.0 • oracle retail xstore point of service 16.0 • oracle retail xstore point of service 17.0 • oracle retail xstore point of service 18.0 • oracle retail xstore point of service 19.0 • oracle weblogic server 12.2.1.3.0 • oracle weblogic server 12.2.1.4.0

Related

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References