OESA-2021-1014

Dashboard / Vulnerabilities / OESA-2021-1014

OESA-2021-1014

Summary: jackson-databind security update

Details: The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration.\r\n\r\n Security Fix(es):\r\n\r\n FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.(CVE-2020-35490)\r\n\r\n FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.(CVE-2020-35491)\r\n\r\n FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).(CVE-2020-35728)\r\n\r\n FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.(CVE-2020-36185)\r\n\r\n

References: https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1014, https://nvd.nist.gov/vuln/detail/CVE-2020-35490, https://nvd.nist.gov/vuln/detail/CVE-2020-35491, https://nvd.nist.gov/vuln/detail/CVE-2020-35728, https://nvd.nist.gov/vuln/detail/CVE-2020-36185