CVE-2020-9547 - 漏洞详情

CVE-2020-9547 (CNNVD-202003-039)

CRITICAL

中文标题:

FasterXML jackson-databind 代码问题漏洞

英文标题:

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadg...

CVSS分数: 9.8

发布时间: 2020-03-02 03:59:08

漏洞类型: 代码问题

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

FasterXML jackson-databind是FasterXML公司的一个基于JAVA可以将XML和JSON等数据格式与JAVA对象进行转换的库。Jackson可以轻松的将Java对象转换成json对象和xml文档，同样也可以将json、xml转换成Java对象。 FasterXML jackson-databind 2.9.10.4之前的2.x版本中存在代码问题漏洞。攻击者可借助特制的请求利用该漏洞在系统上执行任意代码。

英文描述:

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

CWE类型:

CWE-502

受影响产品

厂商	产品	版本	版本范围	平台	CPE
fasterxml	jackson-databind	*	-	-	`cpe:2.3:a:fasterxml:jackson-databind::::::::`
netapp	active_iq_unified_manager	*	-	-	`cpe:2.3:a:netapp:active_iq_unified_manager::::::linux::*`
debian	debian_linux	8.0	-	-	`cpe:2.3:o:debian:debian_linux:8.0:::::::*`
oracle	autovue_for_agile_product_lifecycle_management	21.0.2	-	-	`cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:::::::*`
oracle	banking_platform	*	-	-	`cpe:2.3:a:oracle:banking_platform::::::::`
oracle	communications_contacts_server	8.0.0.4.0	-	-	`cpe:2.3:a:oracle:communications_contacts_server:8.0.0.4.0:::::::*`
oracle	communications_evolved_communications_application_server	7.1	-	-	`cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:::::::*`
oracle	communications_instant_messaging_server	10.0.1.4.0	-	-	`cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.4.0:::::::*`
oracle	communications_network_charging_and_control	*	-	-	`cpe:2.3:a:oracle:communications_network_charging_and_control::::::::`
oracle	communications_network_charging_and_control	6.0.1	-	-	`cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1:::::::*`
oracle	enterprise_manager_base_platform	13.3.0.0	-	-	`cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:::::::*`
oracle	enterprise_manager_base_platform	13.4.0.0	-	-	`cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:::::::*`
oracle	global_lifecycle_management_opatch	*	-	-	`cpe:2.3:a:oracle:global_lifecycle_management_opatch::::::::`
oracle	jd_edwards_enterpriseone_orchestrator	*	-	-	`cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator::::::::`
oracle	jd_edwards_enterpriseone_tools	*	-	-	`cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools::::::::`
oracle	primavera_unifier	*	-	-	`cpe:2.3:a:oracle:primavera_unifier::::::::`
oracle	primavera_unifier	16.1	-	-	`cpe:2.3:a:oracle:primavera_unifier:16.1:::::::*`
oracle	primavera_unifier	16.2	-	-	`cpe:2.3:a:oracle:primavera_unifier:16.2:::::::*`
oracle	primavera_unifier	18.8	-	-	`cpe:2.3:a:oracle:primavera_unifier:18.8:::::::*`
oracle	primavera_unifier	19.12	-	-	`cpe:2.3:a:oracle:primavera_unifier:19.12:::::::*`
oracle	retail_xstore_point_of_service	15.0	-	-	`cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:::::::*`
oracle	retail_xstore_point_of_service	16.0	-	-	`cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:::::::*`
oracle	retail_xstore_point_of_service	17.0	-	-	`cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:::::::*`
oracle	retail_xstore_point_of_service	18.0	-	-	`cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0:::::::*`
oracle	retail_xstore_point_of_service	19.0	-	-	`cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0:::::::*`
oracle	weblogic_server	12.2.1.3.0	-	-	`cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:::::::*`
oracle	weblogic_server	12.2.1.4.0	-	-	`cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:::::::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

[debian-lts-announce] 20200305 [SECURITY] [DLA 2135-1] jackson-databind security update mailing-list
cve.org

访问

[zookeeper-issues] 20200307 [jira] [Created] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546 mailing-list
cve.org

访问

[zookeeper-dev] 20200307 [jira] [Created] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546 mailing-list
cve.org

访问

[zookeeper-issues] 20200307 [jira] [Updated] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546 mailing-list
cve.org

访问

[zookeeper-dev] 20200307 Build failed in Jenkins: PreCommit-ZOOKEEPER-github-pr-build-maven #1898 mailing-list
cve.org

访问

[zookeeper-issues] 20200308 [jira] [Commented] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546 mailing-list
cve.org

访问

[zookeeper-issues] 20200319 [jira] [Commented] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546 mailing-list
cve.org

访问

[zookeeper-issues] 20200319 [jira] [Updated] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546 mailing-list
cve.org

访问

[zookeeper-issues] 20200430 [jira] [Resolved] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546 mailing-list
cve.org

访问