← Back

CVE-2020-36189

nvd nist
Published: Jan 6, 2021Modified: Jun 17, 2026

JSON object

Loading...
8.1
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.2 / Impact: 5.9
Source: NVD

Description

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

Affected (67)

Show all products
Fasterxml: Jackson Databind · Netapp: Cloud Backup, Service Level Manager · Debian: Debian Linux · Oracle: Agile Plm, Application Testing Suite, Autovue For Agile Product Lifecycle Management, Banking Platform, Banking Treasury Management, Banking Virtual Account Management, Blockchain Platform, Commerce Platform, Communications Billing And Revenue Management, Communications Cloud Native Core Policy, Communications Cloud Native Core Unified Data Repository, Communications Convergent Charging Controller, Communications Diameter Signaling Router, Communications Evolved Communications Application Server, Communications Instant Messaging Server, Communications Interactive Session Recorder, Communications Messaging Server, Communications Network Charging And Control, Communications Offline Mediation Controller, Communications Pricing Design Center, Communications Services Gatekeeper, Communications Session Route Manager, Communications Unified Inventory Management, Documaker, Goldengate Application Adapters, Insurance Policy Administration, Insurance Rules Palette, Jd Edwards Enterpriseone Orchestrator, Jd Edwards Enterpriseone Tools, Primavera Gateway, Primavera Unifier, Retail Customer Management And Segmentation Foundation, Retail Merchandising System, Retail Service Backbone, Retail Xstore Point Of Service, Webcenter Portal
Fasterxml
1 product
Jackson Databind
Netapp
2 products
Cloud Backup
Service Level Manager
Debian
1 product
Debian Linux
Oracle
36 products
Agile Plm
Application Testing Suite
Autovue For Agile Product Lifecycle Management
Banking Platform
Banking Treasury Management
Banking Virtual Account Management
Blockchain Platform
Commerce Platform
Communications Billing And Revenue Management
Communications Cloud Native Core Policy
Communications Cloud Native Core Unified Data Repository
Communications Convergent Charging Controller
Communications Diameter Signaling Router
Communications Evolved Communications Application Server
Communications Instant Messaging Server
Communications Interactive Session Recorder
Communications Messaging Server
Communications Network Charging And Control
Communications Offline Mediation Controller
Communications Pricing Design Center
Communications Services Gatekeeper
Communications Session Route Manager
Communications Unified Inventory Management
Documaker
Goldengate Application Adapters
Insurance Policy Administration
Insurance Rules Palette
Jd Edwards Enterpriseone Orchestrator
Jd Edwards Enterpriseone Tools
Primavera Gateway
Primavera Unifier
Retail Customer Management And Segmentation Foundation
Retail Merchandising System
Retail Service Backbone
Retail Xstore Point Of Service
Webcenter Portal
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Fasterxml
Jackson Databind
From 2.0.0 to 2.6.7.5
Jackson Databind
From 2.7.0 to 2.9.10.8
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Cloud Backup
All versions
Service Level Manager
All versions
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
Debian Linux
Version 9.0
Configuration D
62 vulnerable
Vulnerable SoftwareAffected Versions
Agile Plm
Version 9.3.6
Application Testing Suite
Version 13.3.0.1
Autovue For Agile Product Lifecycle Management
Version 21.0.2
Oracle
Banking Platform
Version 2.10.0
Banking Platform
Version 2.6.2
Banking Platform
Version 2.7.0
Banking Platform
Version 2.7.1
Banking Platform
Version 2.8.0
Banking Platform
Version 2.9.0
Banking Treasury Management
Version 14.4
Oracle
Banking Virtual Account Management
Version 14.2.0
Banking Virtual Account Management
Version 14.3.0
Banking Virtual Account Management
Version 14.5.0
Blockchain Platform
Up to 21.1.2
Oracle
Commerce Platform
From 11.3.0 to 11.3.2
Commerce Platform
Version 11.2.0
Oracle
Communications Billing And Revenue Management
Version 12.0.0.3.0
Communications Billing And Revenue Management
Version 7.5.0.23.0
Communications Cloud Native Core Policy
Version 1.14.0
Communications Cloud Native Core Unified Data Repository
Version 1.4.0
Communications Convergent Charging Controller
Version 12.0.4.0.0
Communications Diameter Signaling Router
From 8.0.0 to 8.5.0
Communications Evolved Communications Application Server
Version 7.1
Communications Instant Messaging Server
Version 10.0.1.5.0
Oracle
Communications Interactive Session Recorder
Version 6.3
Communications Interactive Session Recorder
Version 6.4
Oracle
Communications Messaging Server
Version 8.0.2
Communications Messaging Server
Version 8.1
Communications Network Charging And Control
Version 12.0.4.0.0
Communications Offline Mediation Controller
Version 12.0.0.3
Communications Pricing Design Center
Version 12.0.0.4.0
Communications Services Gatekeeper
Version 7.0
Communications Session Route Manager
From 8.2.0.0 to 8.2.2.1
Communications Unified Inventory Management
Version 7.4.1
Oracle
Documaker
Version 12.6.3
Documaker
Version 12.6.4
Goldengate Application Adapters
Version 19.1.0.0.0
Oracle
Insurance Policy Administration
From 11.1.0 to 11.3.0
Insurance Policy Administration
Version 11.0.2
Oracle
Insurance Rules Palette
From 11.1.0 to 11.3.0
Insurance Rules Palette
Version 11.0.2
Jd Edwards Enterpriseone Orchestrator
Before 9.2.5.3
Jd Edwards Enterpriseone Tools
Up to 9.2.5.3
Oracle
Primavera Gateway
From 17.12.0 to 17.12.11
Primavera Gateway
From 18.8.0 to 18.8.11
Primavera Gateway
From 19.12.0 to 19.12.10
Primavera Gateway
Version 20.12.0
Oracle
Primavera Unifier
From 17.7 to 17.12
Primavera Unifier
Version 18.8
Primavera Unifier
Version 19.12
Primavera Unifier
Version 20.12
Retail Customer Management And Segmentation Foundation
From 16.0 to 19.0
Retail Merchandising System
Version 15.0.3
Oracle
Retail Service Backbone
Version 14.1.3.2
Retail Service Backbone
Version 15.0.3.1
Retail Service Backbone
Version 16.0.3
Oracle
Retail Xstore Point Of Service
Version 16.0.6
Retail Xstore Point Of Service
Version 17.0.4
Retail Xstore Point Of Service
Version 18.0.3
Retail Xstore Point Of Service
Version 19.0.2
Oracle
Webcenter Portal
Version 12.2.1.3.0
Webcenter Portal
Version 12.2.1.4.0

Related CWEs

CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (20)

Source: cve@mitre.org
ExploitTechnical DescriptionThird Party Advisory
Source: cve@mitre.org
Issue TrackingThird Party Advisory
Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitTechnical DescriptionThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory

Timeline

No history available yet.