High · published June 15, 2020
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).
| Product | Versions | Fixed in |
|---|---|---|
| fasterxml/jackson-databind | ≥ 2.0.0, < 2.9.10.5 | 2.9.10.5 |
| netapp/active_iq_unified_manager | ≥ 7.3 | — |
| netapp/active_iq_unified_manager | ≥ 7.3 | — |
| netapp/active_iq_unified_manager | ≥ 9.5 | — |
| netapp/steelstore_cloud_integrated_storage | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/communications_calendar_server | all versions | — |
| oracle/communications_contacts_server | all versions | — |
| oracle/communications_diameter_signaling_router | ≥ 8.0.0, ≤ 8.2.2 | — |
| oracle/communications_element_manager | ≥ 8.2.0, ≤ 8.2.2 | — |
| oracle/communications_evolved_communications_application_server | all versions | — |
| oracle/communications_session_report_manager | ≥ 8.2.0, ≤ 8.2.2 | — |
| oracle/communications_session_route_manager | ≥ 8.2.0, ≤ 8.2.2 | — |