CVE-2020-10673

漏洞描述 近日,亚信安全网络攻防实验室跟踪到 jackson-databind 更新了1个jndi注入的黑名单类.如果在项目包中存在该类的jar包且JDK版本满足注入版本,则可以使用JNDI注入的方式导致远程代码执行.该类为 com.caucho.config.types.ResourceRef. 漏洞编号： CVE-2020-10673 Jackson内部编号2660 影响范围 jackson-databind = 2.10.3 fastjson = 1.2.66 修复建议 目前官方已发表修复补丁，可进入...

CVE-2020-10673

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef aka caucho-quercus...

PT-2020-5463

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.0.0 through 2.9.10.3 FasterXML jackson-databind versions 2.6.0 through 2.6.7.3 Description The issue is related to the interaction between serialization gadgets and typing, specifically with...