CVE-2020-14060

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).
References
Link Resource
https://github.com/FasterXML/jackson-databind/issues/2688 Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html Mailing List Third Party Advisory
https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
https://security.netapp.com/advisory/ntap-20200702-0003/ Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2688 Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html Mailing List Third Party Advisory
https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
https://security.netapp.com/advisory/ntap-20200702-0003/ Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:linux:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_digital_experience:18.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_calendar_server:8.0.0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_contacts_server:8.0.0.5.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*

History

21 Nov 2024, 05:02

Type Values Removed Values Added
References () https://github.com/FasterXML/jackson-databind/issues/2688 - Patch, Third Party Advisory () https://github.com/FasterXML/jackson-databind/issues/2688 - Patch, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html - Mailing List, Third Party Advisory
References () https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - () https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 -
References () https://security.netapp.com/advisory/ntap-20200702-0003/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20200702-0003/ - Third Party Advisory
References () https://www.oracle.com//security-alerts/cpujul2021.html - Third Party Advisory () https://www.oracle.com//security-alerts/cpujul2021.html - Third Party Advisory
References () https://www.oracle.com/security-alerts/cpuApr2021.html - Third Party Advisory () https://www.oracle.com/security-alerts/cpuApr2021.html - Third Party Advisory
References () https://www.oracle.com/security-alerts/cpujan2021.html - Third Party Advisory () https://www.oracle.com/security-alerts/cpujan2021.html - Third Party Advisory
References () https://www.oracle.com/security-alerts/cpuoct2020.html - Third Party Advisory () https://www.oracle.com/security-alerts/cpuoct2020.html - Third Party Advisory
References () https://www.oracle.com/security-alerts/cpuoct2021.html - Third Party Advisory () https://www.oracle.com/security-alerts/cpuoct2021.html - Third Party Advisory

07 Nov 2023, 03:17

Type Values Removed Values Added
References
  • {'url': 'https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062', 'name': 'https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062', 'tags': ['Exploit', 'Technical Description', 'Third Party Advisory'], 'refsource': 'MISC'}
  • () https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 -

Information

Published : 2020-06-14 21:15

Updated : 2024-11-21 05:02


NVD link : CVE-2020-14060

Mitre link : CVE-2020-14060

CVE.ORG link : CVE-2020-14060


JSON object : View

Products Affected

oracle

  • communications_element_manager
  • communications_session_report_manager
  • communications_contacts_server
  • communications_diameter_signaling_router
  • communications_calendar_server
  • agile_plm
  • communications_evolved_communications_application_server
  • communications_session_route_manager
  • banking_digital_experience

netapp

  • steelstore_cloud_integrated_storage
  • active_iq_unified_manager

fasterxml

  • jackson-databind
CWE
CWE-502

Deserialization of Untrusted Data