High · published March 19, 2020
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
| Product | Versions | Fixed in |
|---|---|---|
| fasterxml/jackson-databind | ≥ 2.0.0, < 2.6.7.4 | 2.6.7.4 |
| fasterxml/jackson-databind | ≥ 2.9.0, < 2.9.10.4 | 2.9.10.4 |
| debian/debian_linux | all versions | — |
| netapp/steelstore_cloud_integrated_storage | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/autovue_for_agile_product_lifecycle_management | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_platform | ≥ 2.4.0, ≤ 2.9.0 | — |
| oracle/communications_calendar_server | all versions | — |
| oracle/communications_contacts_server | all versions | — |
| oracle/communications_contacts_server | all versions | — |
| oracle/communications_diameter_signaling_router | ≥ 8.0.0, ≤ 8.2.2 | — |
| oracle/communications_element_manager | ≥ 8.2.0, ≤ 8.2.2 | — |
| oracle/communications_evolved_communications_application_server | all versions | — |
| oracle/communications_instant_messaging_server | all versions | — |
| oracle/communications_network_charging_and_control | ≥ 12.0.0, ≤ 12.0.3 | — |
| oracle/communications_network_charging_and_control | all versions | — |
| oracle/communications_session_report_manager | ≥ 8.2.0, ≤ 8.2.2 | — |
| oracle/communications_session_route_manager | ≥ 8.2.0, ≤ 8.2.2 | — |
| oracle/enterprise_manager_base_platform | all versions | — |
| oracle/enterprise_manager_base_platform | all versions | — |
| oracle/financial_services_analytical_applications_infrastructure | ≥ 8.0.6, ≤ 8.1.0 | — |
| oracle/financial_services_institutional_performance_analytics | all versions | — |
| oracle/financial_services_institutional_performance_analytics | all versions | — |
| oracle/financial_services_institutional_performance_analytics | all versions | — |
| oracle/financial_services_price_creation_and_discovery | all versions | — |
| oracle/financial_services_price_creation_and_discovery | all versions | — |
| oracle/financial_services_retail_customer_analytics | all versions | — |
| oracle/global_lifecycle_management_opatch | < 12.2.0.1.20 | 12.2.0.1.20 |
| oracle/insurance_policy_administration_j2ee | all versions | — |
| oracle/insurance_policy_administration_j2ee | all versions | — |
| oracle/jd_edwards_enterpriseone_orchestrator | < 9.2.4.2 | 9.2.4.2 |
| oracle/jd_edwards_enterpriseone_tools | < 9.2.4.2 | 9.2.4.2 |
| oracle/primavera_unifier | ≥ 17.7, ≤ 17.12 | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/retail_merchandising_system | all versions | — |
| oracle/retail_sales_audit | all versions | — |
| oracle/retail_service_backbone | all versions | — |
| oracle/retail_service_backbone | all versions | — |
| oracle/retail_service_backbone | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/weblogic_server | all versions | — |