High · published September 17, 2020
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
| Product | Versions | Fixed in |
|---|---|---|
| fasterxml/jackson-databind | ≥ 2.0.0, < 2.6.7.5 | 2.6.7.5 |
| fasterxml/jackson-databind | ≥ 2.7.0, < 2.9.10.6 | 2.9.10.6 |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/application_testing_suite | all versions | — |
| oracle/autovue_for_agile_product_lifecycle_management | all versions | — |
| oracle/banking_corporate_lending_process_management | all versions | — |
| oracle/banking_corporate_lending_process_management | all versions | — |
| oracle/banking_corporate_lending_process_management | all versions | — |
| oracle/banking_credit_facilities_process_management | all versions | — |
| oracle/banking_credit_facilities_process_management | all versions | — |
| oracle/banking_credit_facilities_process_management | all versions | — |
| oracle/banking_liquidity_management | all versions | — |
| oracle/banking_liquidity_management | all versions | — |
| oracle/banking_liquidity_management | all versions | — |
| oracle/banking_supply_chain_finance | all versions | — |
| oracle/banking_supply_chain_finance | all versions | — |
| oracle/banking_supply_chain_finance | all versions | — |
| oracle/blockchain_platform | < 21.1.2 | 21.1.2 |
| oracle/communications_calendar_server | all versions | — |
| oracle/communications_calendar_server | all versions | — |
| oracle/communications_contacts_server | all versions | — |
| oracle/communications_contacts_server | all versions | — |
| oracle/communications_diameter_signaling_router | ≥ 8.0.0, ≤ 8.2.2 | — |
| oracle/communications_element_manager | ≥ 8.2.0, ≤ 8.2.4.0 | — |
| oracle/communications_instant_messaging_server | all versions | — |
| oracle/communications_messaging_server | all versions | — |
| oracle/communications_offline_mediation_controller | all versions | — |
| oracle/communications_policy_management | all versions | — |
| oracle/communications_pricing_design_center | all versions | — |
| oracle/communications_services_gatekeeper | all versions | — |
| oracle/communications_session_report_manager | ≥ 8.0.0.0, ≤ 8.2.2.1 | — |
| oracle/communications_session_route_manager | ≥ 8.2.0, ≤ 8.2.2.1 | — |
| oracle/communications_unified_inventory_management | all versions | — |
| oracle/identity_manager_connector | all versions | — |
| oracle/siebel_core_-_server_framework | ≤ 21.5 | — |
| oracle/siebel_ui_framework | ≤ 21.2 | — |
| debian/debian_linux | all versions | — |