Critical · published January 3, 2020
⚠️ A missing blocking mechanism in Jackson Databind could lead to unexpected behavior in your applications! 📦 Think of this as a busy delivery service that forgot to put a hold on packages during peak season — without the right checks in place, some important items might get lost or misdelivered! Without the necessary blocks, applications using this version of Jackson Databind could experience unexpected data handling issues, potentially leading to data corruption or application errors. It’s not a full-blown disaster, but it's definitely a slippery slope!
Think of this as a busy delivery service that forgot to put a hold on packages during peak season — without the right checks in place, some important items might get lost or misdelivered! This vulnerability exists in FasterXML's Jackson Databind versions prior to 2.9.10.2, where the lack of blocking from Ehcache can lead to unreliable data processing.
Without the necessary blocks, applications using this version of Jackson Databind could experience unexpected data handling issues, potentially leading to data corruption or application errors. It’s not a full-blown disaster, but it's definitely a slippery slope! To safeguard your systems, upgrade Jackson Databind to version 2.9.10.2 or later as soon as possible. Regularly audit your dependencies and ensure you're using the latest stable releases to avoid similar issues. 🛡️ You've got this! With these steps, you'll keep your applications running smoothly and securely. 🎉
| Product | Versions | Fixed in |
|---|---|---|
| fasterxml/jackson-databind | ≥ 2.0.0, < 2.7.9.7 | 2.7.9.7 |
| fasterxml/jackson-databind | ≥ 2.8.0, < 2.8.11.5 | 2.8.11.5 |
| fasterxml/jackson-databind | ≥ 2.9.0, < 2.9.10.2 | 2.9.10.2 |
| oracle/banking_platform | ≥ 2.4.0, ≤ 2.9.0 | — |
| oracle/communications_billing_and_revenue_management | all versions | — |
| oracle/communications_billing_and_revenue_management | all versions | — |
| oracle/communications_cloud_native_core_network_slice_selection_function | all versions | — |
| oracle/communications_contacts_server | all versions | — |
| oracle/communications_evolved_communications_application_server | all versions | — |
| oracle/communications_instant_messaging_server | all versions | — |
| oracle/communications_network_charging_and_control | ≥ 12.0.0, ≤ 12.0.3 | — |
| oracle/communications_network_charging_and_control | all versions | — |
| oracle/customer_management_and_segmentation_foundation | all versions | — |
| oracle/enterprise_manager_base_platform | all versions | — |
| oracle/enterprise_manager_base_platform | all versions | — |
| oracle/global_lifecycle_management_opatch | < 11.2.0.3.23 | 11.2.0.3.23 |
| oracle/global_lifecycle_management_opatch | ≥ 12.2.0.1.0, < 12.2.0.1.19 | 12.2.0.1.19 |
| oracle/global_lifecycle_management_opatch | ≥ 13.9.4.0.0, < 13.9.4.2.1 | 13.9.4.2.1 |
| oracle/goldengate_application_adapters | all versions | — |
| oracle/goldengate_stream_analytics | < 19.1.0.0.1 | 19.1.0.0.1 |
| oracle/jd_edwards_enterpriseone_orchestrator | < 9.2.4.2 | 9.2.4.2 |
| oracle/jd_edwards_enterpriseone_tools | < 9.2.4.2 | 9.2.4.2 |
| oracle/primavera_unifier | ≥ 17.7, ≤ 17.12 | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/retail_merchandising_system | all versions | — |
| oracle/retail_merchandising_system | all versions | — |
| oracle/retail_merchandising_system | all versions | — |
| oracle/retail_sales_audit | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/siebel_engineering_-_installer_\&_deployment | ≤ 2.20.5 | — |
| oracle/siebel_ui_framework | ≤ 20.5 | — |
| oracle/trace_file_analyzer | all versions | — |
| oracle/trace_file_analyzer | all versions | — |
| oracle/trace_file_analyzer | all versions | — |
| oracle/webcenter_portal | all versions | — |
| oracle/webcenter_portal | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/weblogic_server | all versions | — |
| debian/debian_linux | all versions | — |
| netapp/active_iq_unified_manager | ≥ 7.3 | — |
| netapp/active_iq_unified_manager | ≥ 7.3 | — |
| netapp/active_iq_unified_manager | ≥ 9.5 | — |
| netapp/oncommand_api_services | all versions | — |
| netapp/service_level_manager | all versions | — |
| netapp/snapcenter | all versions | — |
| netapp/steelstore_cloud_integrated_storage | all versions | — |