High · published April 8, 2020
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).
| Product | Versions | Fixed in |
|---|---|---|
| fasterxml/jackson-databind | ≥ 2.0.0, < 2.9.10.4 | 2.9.10.4 |
| debian/debian_linux | all versions | — |
| netapp/active_iq_unified_manager | ≥ 7.3 | — |
| netapp/active_iq_unified_manager | ≥ 7.3 | — |
| netapp/active_iq_unified_manager | ≥ 9.5 | — |
| netapp/steelstore_cloud_integrated_storage | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/banking_platform | ≥ 2.4.0, ≤ 2.9.0 | — |
| oracle/communications_calendar_server | all versions | — |
| oracle/communications_contacts_server | all versions | — |
| oracle/communications_contacts_server | all versions | — |
| oracle/communications_diameter_signaling_router | ≥ 8.0.0, ≤ 8.2.2 | — |
| oracle/communications_evolved_communications_application_server | all versions | — |
| oracle/communications_instant_messaging_server | all versions | — |
| oracle/communications_network_charging_and_control | ≥ 12.0.0, ≤ 12.0.3 | — |
| oracle/communications_network_charging_and_control | all versions | — |
| oracle/enterprise_manager_base_platform | all versions | — |
| oracle/enterprise_manager_base_platform | all versions | — |
| oracle/global_lifecycle_management_opatch | < 12.2.0.1.20 | 12.2.0.1.20 |
| oracle/jd_edwards_enterpriseone_orchestrator | < 9.2.4.2 | 9.2.4.2 |
| oracle/jd_edwards_enterpriseone_tools | < 9.2.4.2 | 9.2.4.2 |
| oracle/primavera_unifier | ≥ 17.7, ≤ 17.12 | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/retail_merchandising_system | all versions | — |
| oracle/retail_sales_audit | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/weblogic_server | all versions | — |