GHSA-9vvp-fxw6-jcxr
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
Package Versions Affected
Automatically patch vulnerabilities without upgrading
CVSS Version
Related Resources
References
https://nvd.nist.gov/vuln/detail/CVE-2020-11113, https://github.com/FasterXML/jackson-databind/issues/2670, https://github.com/FasterXML/jackson-databind/commit/08fbfacf89a4a4c026a6227a1b470ab7a13e2e88, https://github.com/FasterXML/jackson-databind/commit/e2ba12d5d60715d95105e3e790fc234cfb59893d, https://github.com/FasterXML/jackson-databind, https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html, https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062, https://security.netapp.com/advisory/ntap-20200403-0002, https://www.oracle.com/security-alerts/cpujan2021.html, https://www.oracle.com/security-alerts/cpujul2020.html, https://www.oracle.com/security-alerts/cpuoct2020.html, https://www.oracle.com/security-alerts/cpuoct2021.html
Basic Information
