High · published January 7, 2021
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.
| Product | Versions | Fixed in |
|---|---|---|
| fasterxml/jackson-databind | ≥ 2.0.0, < 2.6.7.5 | 2.6.7.5 |
| fasterxml/jackson-databind | ≥ 2.7.0, < 2.9.10.8 | 2.9.10.8 |
| netapp/cloud_backup | all versions | — |
| netapp/service_level_manager | all versions | — |
| debian/debian_linux | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/application_testing_suite | all versions | — |
| oracle/autovue_for_agile_product_lifecycle_management | all versions | — |
| oracle/banking_corporate_lending_process_management | all versions | — |
| oracle/banking_corporate_lending_process_management | all versions | — |
| oracle/banking_corporate_lending_process_management | all versions | — |
| oracle/banking_credit_facilities_process_management | all versions | — |
| oracle/banking_credit_facilities_process_management | all versions | — |
| oracle/banking_credit_facilities_process_management | all versions | — |
| oracle/banking_extensibility_workbench | all versions | — |
| oracle/banking_extensibility_workbench | all versions | — |
| oracle/banking_extensibility_workbench | all versions | — |
| oracle/banking_supply_chain_finance | all versions | — |
| oracle/banking_supply_chain_finance | all versions | — |
| oracle/banking_supply_chain_finance | all versions | — |
| oracle/banking_treasury_management | all versions | — |
| oracle/banking_virtual_account_management | all versions | — |
| oracle/banking_virtual_account_management | all versions | — |
| oracle/banking_virtual_account_management | all versions | — |
| oracle/blockchain_platform | ≤ 21.1.2 | — |
| oracle/commerce_platform | ≥ 11.3.0, ≤ 11.3.2 | — |
| oracle/commerce_platform | all versions | — |
| oracle/communications_billing_and_revenue_management | all versions | — |
| oracle/communications_billing_and_revenue_management | all versions | — |
| oracle/communications_cloud_native_core_policy | all versions | — |
| oracle/communications_cloud_native_core_unified_data_repository | all versions | — |
| oracle/communications_convergent_charging_controller | all versions | — |
| oracle/communications_diameter_signaling_route | ≥ 8.0.0.0, ≤ 8.5.0.0 | — |
| oracle/communications_element_manager | ≥ 8.2.0.0, ≤ 8.2.4.0 | — |
| oracle/communications_evolved_communications_application_server | all versions | — |
| oracle/communications_instant_messaging_server | all versions | — |
| oracle/communications_network_charging_and_control | all versions | — |
| oracle/communications_offline_mediation_controller | all versions | — |
| oracle/communications_policy_management | all versions | — |
| oracle/communications_pricing_design_center | all versions | — |
| oracle/communications_services_gatekeeper | all versions | — |
| oracle/communications_session_report_manager | ≥ 8.0.0.0, ≤ 8.2.2.1 | — |
| oracle/communications_session_route_manager | ≥ 8.2.0.0, ≤ 8.2.2.1 | — |
| oracle/communications_unified_inventory_management | all versions | — |
| oracle/data_integrator | all versions | — |
| oracle/documaker | all versions | — |
| oracle/documaker | all versions | — |
| oracle/documaker | all versions | — |
| oracle/goldengate_application_adapters | all versions | — |
| oracle/insurance_policy_administration | ≥ 11.1.0, ≤ 11.3.0 | — |
| oracle/insurance_policy_administration | all versions | — |
| oracle/insurance_rules_palette | ≥ 11.1.0, ≤ 11.3.0 | — |
| oracle/insurance_rules_palette | all versions | — |
| oracle/jd_edwards_enterpriseone_orchestrator | < 9.2.5.3 | 9.2.5.3 |
| oracle/jd_edwards_enterpriseone_tools | < 9.2.5.3 | 9.2.5.3 |
| oracle/primavera_gateway | ≥ 17.12.0, ≤ 17.12.11 | — |
| oracle/primavera_gateway | ≥ 18.8.0, ≤ 18.8.11 | — |
| oracle/primavera_gateway | ≥ 19.12.0, ≤ 19.12.10 | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_unifier | ≥ 17.7, ≤ 17.12 | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/retail_customer_management_and_segmentation_foundation | ≥ 16.0, ≤ 19.0 | — |
| oracle/retail_merchandising_system | all versions | — |
| oracle/retail_service_backbone | all versions | — |
| oracle/retail_service_backbone | all versions | — |
| oracle/retail_service_backbone | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/webcenter_portal | all versions | — |
| oracle/webcenter_portal | all versions | — |