High · published June 16, 2020
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).
| Product | Versions | Fixed in |
|---|---|---|
| fasterxml/jackson-databind | ≥ 2.9.0, < 2.9.10.5 | 2.9.10.5 |
| netapp/active_iq_unified_manager | ≥ 7.3 | — |
| netapp/active_iq_unified_manager | ≥ 7.3 | — |
| netapp/active_iq_unified_manager | ≥ 9.5 | — |
| netapp/steelstore_cloud_integrated_storage | all versions | — |
| debian/debian_linux | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/communications_calendar_server | all versions | — |
| oracle/communications_contacts_server | all versions | — |
| oracle/communications_diameter_signaling_router | ≥ 8.0.0, ≤ 8.2.2 | — |
| oracle/communications_element_manager | ≥ 8.2.0, ≤ 8.2.2 | — |
| oracle/communications_evolved_communications_application_server | all versions | — |
| oracle/communications_instant_messaging_server | all versions | — |
| oracle/communications_session_report_manager | ≥ 8.2.0, ≤ 8.2.2 | — |
| oracle/communications_session_route_manager | ≥ 8.2.0, ≤ 8.2.2 | — |