CVE-2020-11619

Description

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).

Affected (35)

Products: Fasterxml: Jackson Databind · Debian: Debian Linux · Netapp: Active Iq Unified Manager, Steelstore Cloud Integrated Storage · +1 more

Show all products

1 product

1 product

2 products

Active Iq Unified Manager

Steelstore Cloud Integrated Storage

Oracle

17 products

Agile Plm

Banking Platform

Communications Calendar Server

Communications Contacts Server

Communications Diameter Signaling Router

Communications Evolved Communications Application Server

Communications Instant Messaging Server

Communications Network Charging And Control

Enterprise Manager Base Platform

Global Lifecycle Management Opatch

Jd Edwards Enterpriseone Orchestrator

Jd Edwards Enterpriseone Tools

Primavera Unifier

Retail Merchandising System

Retail Sales Audit

Retail Xstore Point Of Service

Weblogic Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Fasterxml Jackson Databind	From 2.0.0 to 2.9.10.4

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	From 7.3
Netapp Active Iq Unified Manager	From 9.5
Netapp Active Iq Unified Manager	From 7.3
Netapp Steelstore Cloud Integrated Storage	All versions

Configuration D

29 vulnerable

Vulnerable Software	Affected Versions
Oracle Agile Plm	Version 9.3.6
Oracle Banking Platform	From 2.4.0 to 2.9.0
Oracle Communications Calendar Server	Version 8.0.0.4.0
Oracle Communications Contacts Server	Version 8.0.0.4.0
Oracle Communications Contacts Server	Version 8.0.0.5.0
Oracle Communications Diameter Signaling Router	From 8.0.0 to 8.2.2
Oracle Communications Evolved Communications Application Server	Version 7.1
Oracle Communications Instant Messaging Server	Version 10.0.1.4.0
Oracle Communications Network Charging And Control	From 12.0.0 to 12.0.3
Oracle Communications Network Charging And Control	Version 6.0.1
Oracle Enterprise Manager Base Platform	Version 13.3.0.0
Oracle Enterprise Manager Base Platform	Version 13.4.0.0
Oracle Global Lifecycle Management Opatch	Before 12.2.0.1.20
Oracle Jd Edwards Enterpriseone Orchestrator	Before 9.2.4.2
Oracle Jd Edwards Enterpriseone Tools	Before 9.2.4.2
Oracle Primavera Unifier	From 17.7 to 17.12
Oracle Primavera Unifier	Version 16.1
Oracle Primavera Unifier	Version 16.2
Oracle Primavera Unifier	Version 18.8
Oracle Primavera Unifier	Version 19.12
Oracle Retail Merchandising System	Version 15.0
Oracle Retail Sales Audit	Version 14.1
Oracle Retail Xstore Point Of Service	Version 15.0
Oracle Retail Xstore Point Of Service	Version 16.0
Oracle Retail Xstore Point Of Service	Version 17.0
Oracle Retail Xstore Point Of Service	Version 18.0
Oracle Retail Xstore Point Of Service	Version 19.0
Oracle Weblogic Server	Version 12.2.1.3.0
Oracle Weblogic Server	Version 12.2.1.4.0