CVE-2020-11619 - 漏洞详情

CVE-2020-11619 (CNNVD-202004-387)

HIGH

中文标题:

FasterXML jackson-databind 代码问题漏洞

英文标题:

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadg...

CVSS分数: 8.1

发布时间: 2020-04-07 22:14:09

漏洞类型: 代码问题

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

FasterXML jackson-databind是一个基于JAVA可以将XML和JSON等数据格式与JAVA对象进行转换的库。Jackson可以轻松的将Java对象转换成json对象和xml文档，同样也可以将json、xml转换成Java对象。 FasterXML jackson-databind 2.9.10.4之前的2.x版本中存在代码问题漏洞。攻击者可借助特制的输入利用该漏洞在系统上执行任意代码。

英文描述:

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).

CWE类型:

CWE-502

受影响产品

厂商	产品	版本	版本范围	平台	CPE
fasterxml	jackson-databind	*	-	-	`cpe:2.3:a:fasterxml:jackson-databind::::::::`
debian	debian_linux	8.0	-	-	`cpe:2.3:o:debian:debian_linux:8.0:::::::*`
netapp	active_iq_unified_manager	*	-	-	`cpe:2.3:a:netapp:active_iq_unified_manager::::::linux::*`
netapp	steelstore_cloud_integrated_storage	-	-	-	`cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:::::::*`
oracle	agile_plm	9.3.6	-	-	`cpe:2.3:a:oracle:agile_plm:9.3.6:::::::*`
oracle	banking_platform	*	-	-	`cpe:2.3:a:oracle:banking_platform::::::::`
oracle	communications_calendar_server	8.0.0.4.0	-	-	`cpe:2.3:a:oracle:communications_calendar_server:8.0.0.4.0:::::::*`
oracle	communications_contacts_server	8.0.0.4.0	-	-	`cpe:2.3:a:oracle:communications_contacts_server:8.0.0.4.0:::::::*`
oracle	communications_contacts_server	8.0.0.5.0	-	-	`cpe:2.3:a:oracle:communications_contacts_server:8.0.0.5.0:::::::*`
oracle	communications_diameter_signaling_router	*	-	-	`cpe:2.3:a:oracle:communications_diameter_signaling_router::::::::`
oracle	communications_evolved_communications_application_server	7.1	-	-	`cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:::::::*`
oracle	communications_instant_messaging_server	10.0.1.4.0	-	-	`cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.4.0:::::::*`
oracle	communications_network_charging_and_control	*	-	-	`cpe:2.3:a:oracle:communications_network_charging_and_control::::::::`
oracle	communications_network_charging_and_control	6.0.1	-	-	`cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1:::::::*`
oracle	enterprise_manager_base_platform	13.3.0.0	-	-	`cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:::::::*`
oracle	enterprise_manager_base_platform	13.4.0.0	-	-	`cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:::::::*`
oracle	global_lifecycle_management_opatch	*	-	-	`cpe:2.3:a:oracle:global_lifecycle_management_opatch::::::::`
oracle	jd_edwards_enterpriseone_orchestrator	*	-	-	`cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator::::::::`
oracle	jd_edwards_enterpriseone_tools	*	-	-	`cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools::::::::`
oracle	primavera_unifier	*	-	-	`cpe:2.3:a:oracle:primavera_unifier::::::::`
oracle	primavera_unifier	16.1	-	-	`cpe:2.3:a:oracle:primavera_unifier:16.1:::::::*`
oracle	primavera_unifier	16.2	-	-	`cpe:2.3:a:oracle:primavera_unifier:16.2:::::::*`
oracle	primavera_unifier	18.8	-	-	`cpe:2.3:a:oracle:primavera_unifier:18.8:::::::*`
oracle	primavera_unifier	19.12	-	-	`cpe:2.3:a:oracle:primavera_unifier:19.12:::::::*`
oracle	retail_merchandising_system	15.0	-	-	`cpe:2.3:a:oracle:retail_merchandising_system:15.0:::::::*`
oracle	retail_sales_audit	14.1	-	-	`cpe:2.3:a:oracle:retail_sales_audit:14.1:::::::*`
oracle	retail_xstore_point_of_service	15.0	-	-	`cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:::::::*`
oracle	retail_xstore_point_of_service	16.0	-	-	`cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:::::::*`
oracle	retail_xstore_point_of_service	17.0	-	-	`cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:::::::*`
oracle	retail_xstore_point_of_service	18.0	-	-	`cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0:::::::*`
oracle	retail_xstore_point_of_service	19.0	-	-	`cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0:::::::*`
oracle	weblogic_server	12.2.1.3.0	-	-	`cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:::::::*`
oracle	weblogic_server	12.2.1.4.0	-	-	`cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:::::::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

[debian-lts-announce] 20200417 [SECURITY] [DLA 2179-1] jackson-databind security update mailing-list
cve.org

访问