CVE-2020-14061 - 漏洞详情

CVE-2020-14061 (CNNVD-202006-995)

HIGH

中文标题:

FasterXML jackson-databind 代码问题漏洞

英文标题:

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadg...

CVSS分数: 8.1

发布时间: 2020-06-14 19:42:39

漏洞类型: 代码问题

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

FasterXML jackson-databind是FasterXML公司的一个基于JAVA可以将XML和JSON等数据格式与JAVA对象进行转换的库。Jackson可以轻松的将Java对象转换成json对象和xml文档，同样也可以将json、xml转换成Java对象。 FasterXML jackson-databind 2.9.10.5之前的2.x版本中存在代码问题漏洞。目前尚无此漏洞的相关信息，请随时关注CNNVD或厂商公告。

英文描述:

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).

CWE类型:

CWE-502

受影响产品

厂商	产品	版本	版本范围	平台	CPE
fasterxml	jackson-databind	*	-	-	`cpe:2.3:a:fasterxml:jackson-databind::::::::`
netapp	active_iq_unified_manager	*	-	-	`cpe:2.3:a:netapp:active_iq_unified_manager::::::linux::*`
netapp	steelstore_cloud_integrated_storage	-	-	-	`cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:::::::*`
debian	debian_linux	8.0	-	-	`cpe:2.3:o:debian:debian_linux:8.0:::::::*`
oracle	agile_plm	9.3.6	-	-	`cpe:2.3:a:oracle:agile_plm:9.3.6:::::::*`
oracle	autovue_for_agile_product_lifecycle_management	21.0.2	-	-	`cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:::::::*`
oracle	banking_digital_experience	18.1	-	-	`cpe:2.3:a:oracle:banking_digital_experience:18.1:::::::*`
oracle	banking_digital_experience	18.2	-	-	`cpe:2.3:a:oracle:banking_digital_experience:18.2:::::::*`
oracle	banking_digital_experience	18.3	-	-	`cpe:2.3:a:oracle:banking_digital_experience:18.3:::::::*`
oracle	banking_digital_experience	19.1	-	-	`cpe:2.3:a:oracle:banking_digital_experience:19.1:::::::*`
oracle	banking_digital_experience	19.2	-	-	`cpe:2.3:a:oracle:banking_digital_experience:19.2:::::::*`
oracle	banking_digital_experience	20.1	-	-	`cpe:2.3:a:oracle:banking_digital_experience:20.1:::::::*`
oracle	communications_calendar_server	8.0.0.4.0	-	-	`cpe:2.3:a:oracle:communications_calendar_server:8.0.0.4.0:::::::*`
oracle	communications_contacts_server	8.0.0.5.0	-	-	`cpe:2.3:a:oracle:communications_contacts_server:8.0.0.5.0:::::::*`
oracle	communications_diameter_signaling_router	*	-	-	`cpe:2.3:a:oracle:communications_diameter_signaling_router::::::::`
oracle	communications_element_manager	*	-	-	`cpe:2.3:a:oracle:communications_element_manager::::::::`
oracle	communications_evolved_communications_application_server	7.1	-	-	`cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:::::::*`
oracle	communications_instant_messaging_server	10.0.1.4.0	-	-	`cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.4.0:::::::*`
oracle	communications_session_report_manager	*	-	-	`cpe:2.3:a:oracle:communications_session_report_manager::::::::`
oracle	communications_session_route_manager	*	-	-	`cpe:2.3:a:oracle:communications_session_route_manager::::::::`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）