The vulnerability of the Jackson-databind library, related to the restoration of unreliable data in memory, allows an intruder to gain unauthorized access to protected information or cause a service failure.

🗓️ 21 May 2020 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Jackson-databind vulnerability enables remote attackers to restore unreliable data, gaining access.

Reporter	Title	Published	Views	Family All 127
IBM Security Bulletins	Security Bulletin: Common Vulnerabilities found in Cloudera Data Platform Private Cloud base with IBM	2 Mar 202614:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring has patched several open source dependencies	18 Dec 202115:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium Insights is affected by Components with known vulnerabilities	6 Oct 202112:30	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in jackson-databind affects IBM Process Mining (Multiple CVEs)	1 Feb 202321:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Business Intelligence has addressed multiple vulnerabilities (Q12021)	29 Jan 202118:58	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability affects IBM Cloud Object Storage SDK Java (February 2020 Bulletin)	18 Feb 202019:35	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been Identified In Jackson Databind library shipped with IBM Global Mailbox	24 Jul 202017:07	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple CVEs affect IBM Integration Designer	1 Feb 202319:40	–	ibm
IBM Security Bulletins	Security Bulletin: Jackson-databind Security Vulnerability Affects IBM Sterling B2B Integrator (CVE-2019-20330)	24 Jul 202017:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Disconnected Log Collector is vulnerable to using components with known vulnerabilities	16 Jun 202221:33	–	ibm

Vulners

Node

oracle webcenter_portalMatch12.2.1.3.0

OR

oracle retail_customer_management_and_segmentationMatch18.0

OR

oracle webcenter_portalMatch12.2.1.4.0

OR

oracle oracle_global_lifecycle_management_opatchRange11.2.0.0.0–11.2.0.3.23

OR

oracle oracle_global_lifecycle_management_opatchRange12.2.0.0.0–12.2.0.1.19

OR

oracle oracle_global_lifecycle_management_opatchRange13.9.0.0.0–13.9.4.2.1

OR

fasterxml,_llc jackson-databindRange2.0.0–2.9.10.2

Source	Link
github	www.github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.10.1...jackson-databind-2.9.10.2
github	www.github.com/FasterXML/jackson-databind/issues/2526
lists	www.lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d@%3Cdev.zookeeper.apache.org%3E
lists	www.lists.apache.org/thread.html/r2c77dd6ab8344285bd8e481b57cf3029965a4b0036eefccef74cdd44@%3Cnotifications.zookeeper.apache.org%3E
lists	www.lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f@%3Ccommits.druid.apache.org%3E
lists	www.lists.apache.org/thread.html/r3f8180d0d25a7c6473ebb9714b0c1d19a73f455ae70d0c5fefc17e6c@%3Cissues.zookeeper.apache.org%3E
lists	www.lists.apache.org/thread.html/r428735963bee7cb99877b88d3228e28ec28af64646455c4f3e7a3c94@%3Cissues.zookeeper.apache.org%3E
lists	www.lists.apache.org/thread.html/r50f513772f12e1babf65c7c2b9c16425bac2d945351879e2e267517f@%3Cissues.zookeeper.apache.org%3E
lists	www.lists.apache.org/thread.html/r5c14fdcabdeaba258857bcb67198652e4dce1d33ddc590cd81d82393@%3Cdev.zookeeper.apache.org%3E
lists	www.lists.apache.org/thread.html/r5c3644c97f0434d1ceb48ff48897a67bdbf3baf7efbe7d04625425b3@%3Ccommits.druid.apache.org%3E

05 Mar 2025 00:00Current

7.4High risk

Vulners AI Score7.4

CVSS 39.8

CVSS 210

EPSS0.0864

Jackson data bind remote attackers unreliable data memory safety service failures