FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• debian debian linux8.0
• fasterxml jackson-databind2.8.0 and later · before 2.8.11.5
• fasterxml jackson-databind2.9.0 and later · before 2.9.10.2
• fasterxml jackson-databind2.0.0 and later · before 2.7.9.7
• netapp active iq unified manager7.3 and later
• netapp active iq unified manager9.5 and later
• netapp oncommand api servicesall versions
• netapp service level managerall versions
• netapp snapcenterall versions
• netapp steelstore cloud integrated storageall versions
• oracle banking platform2.4.0 and later · up to 2.9.0 inclusive
• oracle communications billing and revenue management12.0.0.3.0
• oracle communications billing and revenue management7.5.0.23.0
• oracle communications cloud native core network slice selection function1.2.1
• oracle communications contacts server8.0.0.4.0
• oracle communications evolved communications application server7.1
• oracle communications instant messaging server10.0.1.4.0
• oracle communications network charging and control12.0.0 and later · up to 12.0.3 inclusive
• oracle communications network charging and control6.0.1
• oracle customer management and segmentation foundation18.0

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2017-17485FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix
  54Plan
• CVE-2017-7525A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthentica
  50Plan
• CVE-2020-8840FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyedi
  47Plan

Published before and after this one in the same product

• ← EarlierCVE-2019-17267Oct 7, 2019 · A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.
  40Plan
• ← EarlierCVE-2019-17531Oct 12, 2019 · A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.
  41Plan
• Later →CVE-2020-9546Mar 2, 2020 · FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.ha
  40Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Data received over the network is deserialized into the language’s native object format without verifying its source. Code paths inside the object can be triggered during deserialization.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1payload = sock.recv(65536)2job = pickle.loads(payload)

1payload = sock.recv(65536)2if not hmac.compare_digest(sign(payload), header_sig):3    raise PermissionError("invalid signature")4job = JobSchema.validate(json.loads(payload))

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.