{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update to the images for Red Hat Integration Service Registry is now available from the Red Hat Container Catalog. The purpose of this text-only errata is to inform you about the security issues fixed in this release.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This release of Red Hat Integration - Service registry 1.1.1.GA serves as a replacement for 1.1.0.GA, and includes the below security fixes.\n\nSecurity Fix(es):\n\n* hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used (CVE-2020-25638)\n\n* jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE) (CVE-2020-25649)\n\n* golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash (CVE-2020-14040)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2021:2039",
        "url": "https://access.redhat.com/errata/RHSA-2021:2039"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://catalog.redhat.com/software/operators/detail/5ef2818e7dc79430ca5f4fd2",
        "url": "https://catalog.redhat.com/software/operators/detail/5ef2818e7dc79430ca5f4fd2"
      },
      {
        "category": "external",
        "summary": "1853652",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1853652"
      },
      {
        "category": "external",
        "summary": "1881353",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1881353"
      },
      {
        "category": "external",
        "summary": "1887664",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1887664"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2039.json"
      }
    ],
    "title": "Red Hat Security Advisory: Service Registry (container images) release and security update [1.1.1.GA]",
    "tracking": {
      "current_release_date": "2024-12-17T21:13:49+00:00",
      "generator": {
        "date": "2024-12-17T21:13:49+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2021:2039",
      "initial_release_date": "2021-05-19T08:01:05+00:00",
      "revision_history": [
        {
          "date": "2021-05-19T08:01:05+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2021-05-19T08:01:05+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-17T21:13:49+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Integration",
                "product": {
                  "name": "Red Hat Integration",
                  "product_id": "Red Hat Integration",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:integration:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Integration"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-14040",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2020-06-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1853652"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service vulnerability was found in the golang.org/x/text library. A library or application must use one of the vulnerable functions, such as unicode.Transform, transform.String, or transform.Byte, to be susceptible to this vulnerability. If an attacker is able to supply specific characters or strings to the vulnerable application, there is the potential to cause an infinite loop to occur using more memory, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "* OpenShift ServiceMesh (OSSM) 1.0 is Out Of Support Scope (OOSS) for Moderate and Low impact vulnerabilities. Jaeger was packaged with ServiceMesh in 1.0, and hence is also marked OOSS, but the Jaeger-Operator is a standalone product and is affected by this vulnerability.\n\n* Because Service Telemetry Framework does not directly use unicode.UTF16, no update will be provided at this time for STF\u0027s sg-core-container.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Integration"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-14040"
        },
        {
          "category": "external",
          "summary": "RHBZ#1853652",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1853652"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-14040",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-14040"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14040",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14040"
        },
        {
          "category": "external",
          "summary": "https://github.com/golang/go/issues/39491",
          "url": "https://github.com/golang/go/issues/39491"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0",
          "url": "https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0"
        }
      ],
      "release_date": "2020-06-17T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-05-19T08:01:05+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Integration"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2039"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Integration"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash"
    },
    {
      "cve": "CVE-2020-25638",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "discovery_date": "2020-09-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1881353"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "For Red Hat Process Automation Manager and Red Hat Decision Manager, the kie-server-ee7 zip is primarily for Weblogic/Websphere which is decided to stay on hibernate 5.1.x, it\u0027s not possible to make an upgrade to 5.3.x due to technical reasons. For this reason this fix is included only for kie-server-ee7. For this reason there are two components for RHPAM and RHDM.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Integration"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-25638"
        },
        {
          "category": "external",
          "summary": "RHBZ#1881353",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1881353"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-25638",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-25638"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-25638",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25638"
        }
      ],
      "release_date": "2020-10-01T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-05-19T08:01:05+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Integration"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2039"
        },
        {
          "category": "workaround",
          "details": "Set hibernate.use_sql_comments to false, which is the default value, or use named parameters instead of literals. Please refer to details in https://docs.jboss.org/hibernate/orm/5.4/userguide/html_single/Hibernate_User_Guide.html#configurations-logging and https://docs.jboss.org/hibernate/orm/5.4/userguide/html_single/Hibernate_User_Guide.html#sql-query-parameters.",
          "product_ids": [
            "Red Hat Integration"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Integration"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used"
    },
    {
      "cve": "CVE-2020-25649",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2020-08-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1887664"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "* Red Hat Enterprise Linux 8 ships a vulnerable version of jackson-databind in the pki-deps:10.6 module. pki-deps:10.6 is for pki-core dependencies, but pki-core does not use the vulnerable DOMDeserializer class and thus has been set to low impact. Future updates may include fixed version of jackson-databind.\n\n* Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind code. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\n* Red Hat Virtualization ships a vulnerable version of jackson-databind, however the vulnerable DOMDeserializer class is not used in the code, therefore reducing impact to low.\n\n* Red Hat OpenShift Container Platform (OCP) ships a vulnerable version of jackson-databind, but in the affected containers the DOMDeserializer class is not used. Additionally access to the containers is restricted to authenticated users only (OpenShift OAuth authentication) reducing the severity of this vulnerability to Low.\nIn OCP 4 there are no plans to maintain ose-logging-elasticsearch5 container, hence marked as wontfix.\n\n* Red Hat Satellite ships affected version of jackson-databind through Candlepin, however, product code does not use DOMDeserializer class and jackson-databind in a vulnerable way. Thus impact has been set to low. A future release may update jackson-databind to a fixed version.\n\n* Red Hat Single Sign-On (RH-SSO) ships affected version of jackson-databind, however, none of the product code is using the affected class (DOMDeserializer). Thus impact has been set to low. RH-SSO will consume the fixed artifact from EAP in the next CP.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Integration"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-25649"
        },
        {
          "category": "external",
          "summary": "RHBZ#1887664",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1887664"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-25649",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-25649"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-25649",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25649"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/issues/2589",
          "url": "https://github.com/FasterXML/jackson-databind/issues/2589"
        }
      ],
      "release_date": "2020-01-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-05-19T08:01:05+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Integration"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2039"
        },
        {
          "category": "workaround",
          "details": "There is currently no known mitigation for this flaw.",
          "product_ids": [
            "Red Hat Integration"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Integration"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat Process Automation Manager.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Process Automation Manager is an open source business process management suite that combines process management and decision service management and enables business and IT users to create, manage, validate, and deploy process applications and decision services.\n\nThis release of Red Hat Process Automation Manager 7.11.0 serves as an update to Red Hat Process Automation Manager 7.10.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* xmlgraphics-commons: SSRF due to improper input validation by the XMPParser (CVE-2020-11988)\n\n* xstream: allow a remote attacker to cause DoS only by manipulating the processed input stream (CVE-2021-21341)\n\n* xstream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream (CVE-2021-21351)\n\n* xstream: arbitrary file deletion on the local host via crafted input stream (CVE-2021-21343)\n\n* xstream: arbitrary file deletion on the local host when unmarshalling (CVE-2020-26259)\n\n* xstream: ReDoS vulnerability (CVE-2021-21348)\n\n* xstream: Server-Side Forgery Request vulnerability can be activated when unmarshalling (CVE-2020-26258)\n\n* xstream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host (CVE-2021-21349)\n\n* xstream: SSRF via crafted input stream (CVE-2021-21342)\n\n* jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE) (CVE-2020-25649)\n\n* xstream: allow a remote attacker to execute arbitrary code only by manipulating the processed input stream (CVE-2021-21350)\n\n* xstream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream (CVE-2021-21347)\n\n* xstream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream (CVE-2021-21346)\n\n* xstream: allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream (CVE-2021-21345)\n\n* xstream: arbitrary code execution via crafted input stream (CVE-2021-21344)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2021:2475",
        "url": "https://access.redhat.com/errata/RHSA-2021:2475"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1887664",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1887664"
      },
      {
        "category": "external",
        "summary": "1908832",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1908832"
      },
      {
        "category": "external",
        "summary": "1908837",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1908837"
      },
      {
        "category": "external",
        "summary": "1933816",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1933816"
      },
      {
        "category": "external",
        "summary": "1942539",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942539"
      },
      {
        "category": "external",
        "summary": "1942545",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942545"
      },
      {
        "category": "external",
        "summary": "1942550",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942550"
      },
      {
        "category": "external",
        "summary": "1942554",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942554"
      },
      {
        "category": "external",
        "summary": "1942558",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942558"
      },
      {
        "category": "external",
        "summary": "1942578",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942578"
      },
      {
        "category": "external",
        "summary": "1942629",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942629"
      },
      {
        "category": "external",
        "summary": "1942633",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942633"
      },
      {
        "category": "external",
        "summary": "1942635",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942635"
      },
      {
        "category": "external",
        "summary": "1942637",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942637"
      },
      {
        "category": "external",
        "summary": "1942642",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942642"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2475.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Process Automation Manager 7.11.0 security update",
    "tracking": {
      "current_release_date": "2024-11-24T21:24:24+00:00",
      "generator": {
        "date": "2024-11-24T21:24:24+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2021:2475",
      "initial_release_date": "2021-06-17T13:14:44+00:00",
      "revision_history": [
        {
          "date": "2021-06-17T13:14:44+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2021-06-17T13:14:44+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-24T21:24:24+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHPAM 7.11.0",
                "product": {
                  "name": "RHPAM 7.11.0",
                  "product_id": "RHPAM 7.11.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7.11"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Process Automation Manager"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-11988",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2021-02-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1933816"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users should upgrade to 2.6 or later.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xmlgraphics-commons: SSRF due to improper input validation by the XMPParser",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw does not affect xmlgraphics-commons as shipped with Red Hat Enterprise Linux 8. It is out of support scope for Red Hat Enterprise Linux 6 and 7. To  learn more about support scope for Red Hat Enterprise Linux, please see https://access.redhat.com/support/policy/updates/errata/ .",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHPAM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-11988"
        },
        {
          "category": "external",
          "summary": "RHBZ#1933816",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1933816"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11988",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-11988"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11988",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11988"
        },
        {
          "category": "external",
          "summary": "https://xmlgraphics.apache.org/security.html",
          "url": "https://xmlgraphics.apache.org/security.html"
        }
      ],
      "release_date": "2021-02-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:14:44+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHPAM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2475"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "RHPAM 7.11.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "RHPAM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "xmlgraphics-commons: SSRF due to improper input validation by the XMPParser"
    },
    {
      "cve": "CVE-2020-25649",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2020-08-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1887664"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "* Red Hat Enterprise Linux 8 ships a vulnerable version of jackson-databind in the pki-deps:10.6 module. pki-deps:10.6 is for pki-core dependencies, but pki-core does not use the vulnerable DOMDeserializer class and thus has been set to low impact. Future updates may include fixed version of jackson-databind.\n\n* Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind code. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\n* Red Hat Virtualization ships a vulnerable version of jackson-databind, however the vulnerable DOMDeserializer class is not used in the code, therefore reducing impact to low.\n\n* Red Hat OpenShift Container Platform (OCP) ships a vulnerable version of jackson-databind, but in the affected containers the DOMDeserializer class is not used. Additionally access to the containers is restricted to authenticated users only (OpenShift OAuth authentication) reducing the severity of this vulnerability to Low.\nIn OCP 4 there are no plans to maintain ose-logging-elasticsearch5 container, hence marked as wontfix.\n\n* Red Hat Satellite ships affected version of jackson-databind through Candlepin, however, product code does not use DOMDeserializer class and jackson-databind in a vulnerable way. Thus impact has been set to low. A future release may update jackson-databind to a fixed version.\n\n* Red Hat Single Sign-On (RH-SSO) ships affected version of jackson-databind, however, none of the product code is using the affected class (DOMDeserializer). Thus impact has been set to low. RH-SSO will consume the fixed artifact from EAP in the next CP.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHPAM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-25649"
        },
        {
          "category": "external",
          "summary": "RHBZ#1887664",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1887664"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-25649",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-25649"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-25649",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25649"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/issues/2589",
          "url": "https://github.com/FasterXML/jackson-databind/issues/2589"
        }
      ],
      "release_date": "2020-01-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:14:44+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHPAM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2475"
        },
        {
          "category": "workaround",
          "details": "There is currently no known mitigation for this flaw.",
          "product_ids": [
            "RHPAM 7.11.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "RHPAM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)"
    },
    {
      "cve": "CVE-2020-26258",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2020-12-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1908832"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream\u0027s Security Framework with a whitelist! Anyone relying on XStream\u0027s default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers jenkins package with bundled XStream library. Due to JEP-200 Jenkins project [1] and advisory SECURITY-383 [2], OCP jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://www.jenkins.io/security/advisory/2017-02-01/  (see SECURITY-383 / CVE-2017-2608)",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHPAM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-26258"
        },
        {
          "category": "external",
          "summary": "RHBZ#1908832",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1908832"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-26258",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-26258"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-26258",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26258"
        }
      ],
      "release_date": "2020-12-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:14:44+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHPAM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2475"
        },
        {
          "category": "workaround",
          "details": "As recommended, use XStream\u0027s security framework to implement a whitelist for the allowed types.\n\nUsers of XStream 1.4.14 who insist to use XStream default blacklist - despite that clear recommendation - can simply add two lines to XStream\u0027s setup code:\n\nxstream.denyTypes(new String[]{ \"jdk.nashorn.internal.objects.NativeString\" });\nxstream.denyTypesByRegExp(new String[]{ \".*\\\\.ReadAllStream\\\\$FileStream\" });\n\nUsers of XStream 1.4.13 who want to use XStream default blacklist can simply add three lines to XStream\u0027s setup code:\n\nxstream.denyTypes(new String[]{ \"javax.imageio.ImageIO$ContainsFilter\", \"jdk.nashorn.internal.objects.NativeString\" });\nxstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class });\nxstream.denyTypesByRegExp(new String[]{ \".*\\\\.ReadAllStream\\\\$FileStream\" });\n\nUsers of XStream 1.4.12 to 1.4.7 who want to use XStream with a blacklist will have to setup such a list from scratch and deny at least the following types: javax.imageio.ImageIO$ContainsFilter, java.beans.EventHandler, java.lang.ProcessBuilder, jdk.nashorn.internal.objects.NativeString, java.lang.Void and void and deny several types by name pattern.\n\nxstream.denyTypes(new String[]{ \"javax.imageio.ImageIO$ContainsFilter\", \"jdk.nashorn.internal.objects.NativeString\" });\nxstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class });\nxstream.denyTypesByRegExp(new String[]{ \".*\\\\$LazyIterator\", \"javax\\\\.crypto\\\\..*\", \".*\\\\.ReadAllStream\\\\$FileStream\" });\n\nUsers of XStream 1.4.6 or below can register an own converter to prevent the unmarshalling of the currently know critical types of the Java runtime. It is in fact an updated version of the workaround for CVE-2013-7285:\n\nxstream.registerConverter(new Converter() {\n  public boolean canConvert(Class type) {\n    return type != null \u0026\u0026 (type == java.beans.EventHandler.class || type == java.lang.ProcessBuilder.class\n        || type.getName().equals(\"javax.imageio.ImageIO$ContainsFilter\") || type.getName().equals(\"jdk.nashorn.internal.objects.NativeString\")\n        || type == java.lang.Void.class || void.class || Proxy.isProxy(type)\n        || type.getName().startsWith(\"javax.crypto.\") || type.getName().endsWith(\"$LazyIterator\") || type.getName().endsWith(\".ReadAllStream$FileStream\"));\n  }\n\n  public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) {\n    throw new ConversionException(\"Unsupported type due to security reasons.\");\n  }\n\n  public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) {\n    throw new ConversionException(\"Unsupported type due to security reasons.\");\n  }\n}, XStream.PRIORITY_LOW);",
          "product_ids": [
            "RHPAM 7.11.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "RHPAM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling"
    },
    {
      "cve": "CVE-2020-26259",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2020-12-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1908837"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream\u0027s Security Framework with a whitelist! Anyone relying on XStream\u0027s default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: arbitrary file deletion on the local host when unmarshalling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers jenkins package with bundled XStream library. Due to JEP-200 Jenkins project [1] and advisory SECURITY-383 [2], OCP jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://www.jenkins.io/security/advisory/2017-02-01/  (see SECURITY-383 / CVE-2017-2608)",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHPAM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-26259"
        },
        {
          "category": "external",
          "summary": "RHBZ#1908837",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1908837"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-26259",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-26259"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-26259",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26259"
        }
      ],
      "release_date": "2020-12-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:14:44+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHPAM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2475"
        },
        {
          "category": "workaround",
          "details": "As recommended, use XStream\u0027s security framework to implement a whitelist for the allowed types.\n\nUsers of XStream 1.4.14 who insist to use XStream default blacklist - despite that clear recommendation - can simply add two lines to XStream\u0027s setup code:\n\nxstream.denyTypes(new String[]{ \"jdk.nashorn.internal.objects.NativeString\" });\nxstream.denyTypesByRegExp(new String[]{ \".*\\\\.ReadAllStream\\\\$FileStream\" });\n\nUsers of XStream 1.4.13 who want to use XStream default blacklist can simply add three lines to XStream\u0027s setup code:\n\nxstream.denyTypes(new String[]{ \"javax.imageio.ImageIO$ContainsFilter\", \"jdk.nashorn.internal.objects.NativeString\" });\nxstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class });\nxstream.denyTypesByRegExp(new String[]{ \".*\\\\.ReadAllStream\\\\$FileStream\" });\n\nUsers of XStream 1.4.12 to 1.4.7 who want to use XStream with a blacklist will have to setup such a list from scratch and deny at least the following types: javax.imageio.ImageIO$ContainsFilter, java.beans.EventHandler, java.lang.ProcessBuilder, jdk.nashorn.internal.objects.NativeString, java.lang.Void and void and deny several types by name pattern.\n\nxstream.denyTypes(new String[]{ \"javax.imageio.ImageIO$ContainsFilter\", \"jdk.nashorn.internal.objects.NativeString\" });\nxstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class });\nxstream.denyTypesByRegExp(new String[]{ \".*\\\\$LazyIterator\", \"javax\\\\.crypto\\\\..*\", \".*\\\\.ReadAllStream\\\\$FileStream\" });\n\nUsers of XStream 1.4.6 or below can register an own converter to prevent the unmarshalling of the currently know critical types of the Java runtime. It is in fact an updated version of the workaround for CVE-2013-7285:\n\nxstream.registerConverter(new Converter() {\n  public boolean canConvert(Class type) {\n    return type != null \u0026\u0026 (type == java.beans.EventHandler.class || type == java.lang.ProcessBuilder.class\n        || type.getName().equals(\"javax.imageio.ImageIO$ContainsFilter\") || type.getName().equals(\"jdk.nashorn.internal.objects.NativeString\")\n        || type == java.lang.Void.class || void.class || Proxy.isProxy(type)\n        || type.getName().startsWith(\"javax.crypto.\") || type.getName().endsWith(\"$LazyIterator\") || type.getName().endsWith(\".ReadAllStream$FileStream\"));\n  }\n\n  public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) {\n    throw new ConversionException(\"Unsupported type due to security reasons.\");\n  }\n\n  public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) {\n    throw new ConversionException(\"Unsupported type due to security reasons.\");\n  }\n}, XStream.PRIORITY_LOW);",
          "product_ids": [
            "RHPAM 7.11.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "RHPAM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "XStream: arbitrary file deletion on the local host when unmarshalling"
    },
    {
      "cve": "CVE-2021-21341",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2021-03-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1942539"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: allow a remote attacker to cause DoS only by manipulating the processed input stream",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHPAM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-21341"
        },
        {
          "category": "external",
          "summary": "RHBZ#1942539",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942539"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-21341",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21341"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-21341",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21341"
        }
      ],
      "release_date": "2021-03-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:14:44+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHPAM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2475"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "RHPAM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "XStream: allow a remote attacker to cause DoS only by manipulating the processed input stream"
    },
    {
      "cve": "CVE-2021-21342",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2021-03-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1942545"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: SSRF via crafted input stream",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHPAM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-21342"
        },
        {
          "category": "external",
          "summary": "RHBZ#1942545",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942545"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-21342",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21342"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-21342",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21342"
        }
      ],
      "release_date": "2021-03-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:14:44+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHPAM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2475"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "RHPAM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "XStream: SSRF via crafted input stream"
    },
    {
      "cve": "CVE-2021-21343",
      "cwe": {
        "id": "CWE-552",
        "name": "Files or Directories Accessible to External Parties"
      },
      "discovery_date": "2021-03-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1942550"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in the deletion of a file on the local host. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: arbitrary file deletion on the local host via crafted input stream",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHPAM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-21343"
        },
        {
          "category": "external",
          "summary": "RHBZ#1942550",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942550"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-21343",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21343"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-21343",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21343"
        }
      ],
      "release_date": "2021-03-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:14:44+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHPAM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2475"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "RHPAM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "XStream: arbitrary file deletion on the local host via crafted input stream"
    },
    {
      "cve": "CVE-2021-21344",
      "cwe": {
        "id": "CWE-434",
        "name": "Unrestricted Upload of File with Dangerous Type"
      },
      "discovery_date": "2021-03-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1942554"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xstream. A remote attacker may be able to load and execute arbitrary code from a remote host only by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: Unsafe deserizaliation of javax.sql.rowset.BaseRowSet",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHPAM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-21344"
        },
        {
          "category": "external",
          "summary": "RHBZ#1942554",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942554"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-21344",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21344"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-21344",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21344"
        }
      ],
      "release_date": "2021-03-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:14:44+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHPAM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2475"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "RHPAM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "XStream: Unsafe deserizaliation of javax.sql.rowset.BaseRowSet"
    },
    {
      "cve": "CVE-2021-21345",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2021-03-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1942558"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xstream. A remote attacker, who has sufficient rights, can execute commands of the host by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: Unsafe deserizaliation of com.sun.corba.se.impl.activation.ServerTableEntry",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHPAM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-21345"
        },
        {
          "category": "external",
          "summary": "RHBZ#1942558",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942558"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-21345",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21345"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-21345",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21345"
        }
      ],
      "release_date": "2021-03-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:14:44+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHPAM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2475"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "RHPAM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "XStream: Unsafe deserizaliation of com.sun.corba.se.impl.activation.ServerTableEntry"
    },
    {
      "cve": "CVE-2021-21346",
      "cwe": {
        "id": "CWE-434",
        "name": "Unrestricted Upload of File with Dangerous Type"
      },
      "discovery_date": "2021-03-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1942578"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xstream. A remote attacker can load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: Unsafe deserizaliation of sun.swing.SwingLazyValue",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHPAM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-21346"
        },
        {
          "category": "external",
          "summary": "RHBZ#1942578",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942578"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-21346",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21346"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-21346",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21346"
        }
      ],
      "release_date": "2021-03-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:14:44+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHPAM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2475"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "RHPAM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "XStream: Unsafe deserizaliation of sun.swing.SwingLazyValue"
    },
    {
      "cve": "CVE-2021-21347",
      "cwe": {
        "id": "CWE-434",
        "name": "Unrestricted Upload of File with Dangerous Type"
      },
      "discovery_date": "2021-03-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1942629"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xstream. A remote attacker may be able to load and execute arbitrary code from a remote host only by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHPAM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-21347"
        },
        {
          "category": "external",
          "summary": "RHBZ#1942629",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942629"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-21347",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21347"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-21347",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21347"
        }
      ],
      "release_date": "2021-03-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:14:44+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHPAM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2475"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "RHPAM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator"
    },
    {
      "cve": "CVE-2021-21348",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2021-03-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1942633"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: ReDoS vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHPAM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-21348"
        },
        {
          "category": "external",
          "summary": "RHBZ#1942633",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942633"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-21348",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21348"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-21348",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21348"
        }
      ],
      "release_date": "2021-03-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:14:44+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHPAM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2475"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "RHPAM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "XStream: ReDoS vulnerability"
    },
    {
      "cve": "CVE-2021-21349",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2021-03-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1942635"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHPAM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-21349"
        },
        {
          "category": "external",
          "summary": "RHBZ#1942635",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942635"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-21349",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21349"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-21349",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21349"
        }
      ],
      "release_date": "2021-03-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:14:44+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHPAM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2475"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "RHPAM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host"
    },
    {
      "cve": "CVE-2021-21350",
      "cwe": {
        "id": "CWE-434",
        "name": "Unrestricted Upload of File with Dangerous Type"
      },
      "discovery_date": "2021-03-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1942637"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xstream. A remote attacker may be able to execute arbitrary code only by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: Unsafe deserizaliation of com.sun.org.apache.bcel.internal.util.ClassLoader",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHPAM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-21350"
        },
        {
          "category": "external",
          "summary": "RHBZ#1942637",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942637"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-21350",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21350"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-21350",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21350"
        }
      ],
      "release_date": "2021-03-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:14:44+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHPAM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2475"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "RHPAM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "XStream: Unsafe deserizaliation of com.sun.org.apache.bcel.internal.util.ClassLoader"
    },
    {
      "cve": "CVE-2021-21351",
      "cwe": {
        "id": "CWE-434",
        "name": "Unrestricted Upload of File with Dangerous Type"
      },
      "discovery_date": "2021-03-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1942642"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHPAM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-21351"
        },
        {
          "category": "external",
          "summary": "RHBZ#1942642",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942642"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-21351",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21351"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-21351",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21351"
        }
      ],
      "release_date": "2021-03-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:14:44+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHPAM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2475"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "RHPAM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat Decision Manager.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Decision Manager is an open source decision management platform that combines business rules management, complex event processing, Decision Model \u0026 Notation (DMN) execution, and Business Optimizer for solving planning problems. It automates business decisions and makes that logic available to the entire business. \n\nThis release of Red Hat Decision Manager 7.11.0 serves as an update to Red Hat Decision Manager 7.10.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* xmlgraphics-commons: SSRF due to improper input validation by the XMPParser (CVE-2020-11988)\n\n* xstream: allow a remote attacker to cause DoS only by manipulating the processed input stream (CVE-2021-21341)\n\n* xstream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream (CVE-2021-21351)\n\n* xstream: arbitrary file deletion on the local host via crafted input stream (CVE-2021-21343)\n\n* xstream: arbitrary file deletion on the local host when unmarshalling (CVE-2020-26259)\n\n* xstream: ReDoS vulnerability (CVE-2021-21348)\n\n* xstream: Server-Side Forgery Request vulnerability can be activated when unmarshalling (CVE-2020-26258)\n\n* xstream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host (CVE-2021-21349)\n\n* xstream: SSRF via crafted input stream (CVE-2021-21342)\n\n* jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE) (CVE-2020-25649)\n\n* xstream: allow a remote attacker to execute arbitrary code only by manipulating the processed input stream (CVE-2021-21350)\n\n* xstream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream (CVE-2021-21346)\n\n* xstream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream (CVE-2021-21347)\n\n* xstream: allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream (CVE-2021-21345)\n\n* xstream: arbitrary code execution via crafted input stream (CVE-2021-21344)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2021:2476",
        "url": "https://access.redhat.com/errata/RHSA-2021:2476"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1887664",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1887664"
      },
      {
        "category": "external",
        "summary": "1908832",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1908832"
      },
      {
        "category": "external",
        "summary": "1908837",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1908837"
      },
      {
        "category": "external",
        "summary": "1933816",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1933816"
      },
      {
        "category": "external",
        "summary": "1942539",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942539"
      },
      {
        "category": "external",
        "summary": "1942545",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942545"
      },
      {
        "category": "external",
        "summary": "1942550",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942550"
      },
      {
        "category": "external",
        "summary": "1942554",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942554"
      },
      {
        "category": "external",
        "summary": "1942558",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942558"
      },
      {
        "category": "external",
        "summary": "1942578",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942578"
      },
      {
        "category": "external",
        "summary": "1942629",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942629"
      },
      {
        "category": "external",
        "summary": "1942633",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942633"
      },
      {
        "category": "external",
        "summary": "1942635",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942635"
      },
      {
        "category": "external",
        "summary": "1942637",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942637"
      },
      {
        "category": "external",
        "summary": "1942642",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942642"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2476.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Decision Manager 7.11.0 security update",
    "tracking": {
      "current_release_date": "2024-11-24T21:24:19+00:00",
      "generator": {
        "date": "2024-11-24T21:24:19+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2021:2476",
      "initial_release_date": "2021-06-17T13:15:14+00:00",
      "revision_history": [
        {
          "date": "2021-06-17T13:15:14+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2021-06-17T13:15:14+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-24T21:24:19+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHDM 7.11.0",
                "product": {
                  "name": "RHDM 7.11.0",
                  "product_id": "RHDM 7.11.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_brms_platform:7.11"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Decision Manager"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-11988",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2021-02-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1933816"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users should upgrade to 2.6 or later.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xmlgraphics-commons: SSRF due to improper input validation by the XMPParser",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw does not affect xmlgraphics-commons as shipped with Red Hat Enterprise Linux 8. It is out of support scope for Red Hat Enterprise Linux 6 and 7. To  learn more about support scope for Red Hat Enterprise Linux, please see https://access.redhat.com/support/policy/updates/errata/ .",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHDM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-11988"
        },
        {
          "category": "external",
          "summary": "RHBZ#1933816",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1933816"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11988",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-11988"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11988",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11988"
        },
        {
          "category": "external",
          "summary": "https://xmlgraphics.apache.org/security.html",
          "url": "https://xmlgraphics.apache.org/security.html"
        }
      ],
      "release_date": "2021-02-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:15:14+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHDM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2476"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "RHDM 7.11.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "RHDM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "xmlgraphics-commons: SSRF due to improper input validation by the XMPParser"
    },
    {
      "cve": "CVE-2020-25649",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2020-08-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1887664"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "* Red Hat Enterprise Linux 8 ships a vulnerable version of jackson-databind in the pki-deps:10.6 module. pki-deps:10.6 is for pki-core dependencies, but pki-core does not use the vulnerable DOMDeserializer class and thus has been set to low impact. Future updates may include fixed version of jackson-databind.\n\n* Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind code. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\n* Red Hat Virtualization ships a vulnerable version of jackson-databind, however the vulnerable DOMDeserializer class is not used in the code, therefore reducing impact to low.\n\n* Red Hat OpenShift Container Platform (OCP) ships a vulnerable version of jackson-databind, but in the affected containers the DOMDeserializer class is not used. Additionally access to the containers is restricted to authenticated users only (OpenShift OAuth authentication) reducing the severity of this vulnerability to Low.\nIn OCP 4 there are no plans to maintain ose-logging-elasticsearch5 container, hence marked as wontfix.\n\n* Red Hat Satellite ships affected version of jackson-databind through Candlepin, however, product code does not use DOMDeserializer class and jackson-databind in a vulnerable way. Thus impact has been set to low. A future release may update jackson-databind to a fixed version.\n\n* Red Hat Single Sign-On (RH-SSO) ships affected version of jackson-databind, however, none of the product code is using the affected class (DOMDeserializer). Thus impact has been set to low. RH-SSO will consume the fixed artifact from EAP in the next CP.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHDM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-25649"
        },
        {
          "category": "external",
          "summary": "RHBZ#1887664",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1887664"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-25649",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-25649"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-25649",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25649"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/issues/2589",
          "url": "https://github.com/FasterXML/jackson-databind/issues/2589"
        }
      ],
      "release_date": "2020-01-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:15:14+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHDM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2476"
        },
        {
          "category": "workaround",
          "details": "There is currently no known mitigation for this flaw.",
          "product_ids": [
            "RHDM 7.11.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "RHDM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)"
    },
    {
      "cve": "CVE-2020-26258",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2020-12-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1908832"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream\u0027s Security Framework with a whitelist! Anyone relying on XStream\u0027s default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers jenkins package with bundled XStream library. Due to JEP-200 Jenkins project [1] and advisory SECURITY-383 [2], OCP jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://www.jenkins.io/security/advisory/2017-02-01/  (see SECURITY-383 / CVE-2017-2608)",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHDM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-26258"
        },
        {
          "category": "external",
          "summary": "RHBZ#1908832",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1908832"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-26258",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-26258"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-26258",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26258"
        }
      ],
      "release_date": "2020-12-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:15:14+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHDM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2476"
        },
        {
          "category": "workaround",
          "details": "As recommended, use XStream\u0027s security framework to implement a whitelist for the allowed types.\n\nUsers of XStream 1.4.14 who insist to use XStream default blacklist - despite that clear recommendation - can simply add two lines to XStream\u0027s setup code:\n\nxstream.denyTypes(new String[]{ \"jdk.nashorn.internal.objects.NativeString\" });\nxstream.denyTypesByRegExp(new String[]{ \".*\\\\.ReadAllStream\\\\$FileStream\" });\n\nUsers of XStream 1.4.13 who want to use XStream default blacklist can simply add three lines to XStream\u0027s setup code:\n\nxstream.denyTypes(new String[]{ \"javax.imageio.ImageIO$ContainsFilter\", \"jdk.nashorn.internal.objects.NativeString\" });\nxstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class });\nxstream.denyTypesByRegExp(new String[]{ \".*\\\\.ReadAllStream\\\\$FileStream\" });\n\nUsers of XStream 1.4.12 to 1.4.7 who want to use XStream with a blacklist will have to setup such a list from scratch and deny at least the following types: javax.imageio.ImageIO$ContainsFilter, java.beans.EventHandler, java.lang.ProcessBuilder, jdk.nashorn.internal.objects.NativeString, java.lang.Void and void and deny several types by name pattern.\n\nxstream.denyTypes(new String[]{ \"javax.imageio.ImageIO$ContainsFilter\", \"jdk.nashorn.internal.objects.NativeString\" });\nxstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class });\nxstream.denyTypesByRegExp(new String[]{ \".*\\\\$LazyIterator\", \"javax\\\\.crypto\\\\..*\", \".*\\\\.ReadAllStream\\\\$FileStream\" });\n\nUsers of XStream 1.4.6 or below can register an own converter to prevent the unmarshalling of the currently know critical types of the Java runtime. It is in fact an updated version of the workaround for CVE-2013-7285:\n\nxstream.registerConverter(new Converter() {\n  public boolean canConvert(Class type) {\n    return type != null \u0026\u0026 (type == java.beans.EventHandler.class || type == java.lang.ProcessBuilder.class\n        || type.getName().equals(\"javax.imageio.ImageIO$ContainsFilter\") || type.getName().equals(\"jdk.nashorn.internal.objects.NativeString\")\n        || type == java.lang.Void.class || void.class || Proxy.isProxy(type)\n        || type.getName().startsWith(\"javax.crypto.\") || type.getName().endsWith(\"$LazyIterator\") || type.getName().endsWith(\".ReadAllStream$FileStream\"));\n  }\n\n  public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) {\n    throw new ConversionException(\"Unsupported type due to security reasons.\");\n  }\n\n  public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) {\n    throw new ConversionException(\"Unsupported type due to security reasons.\");\n  }\n}, XStream.PRIORITY_LOW);",
          "product_ids": [
            "RHDM 7.11.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "RHDM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling"
    },
    {
      "cve": "CVE-2020-26259",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2020-12-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1908837"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream\u0027s Security Framework with a whitelist! Anyone relying on XStream\u0027s default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: arbitrary file deletion on the local host when unmarshalling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers jenkins package with bundled XStream library. Due to JEP-200 Jenkins project [1] and advisory SECURITY-383 [2], OCP jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://www.jenkins.io/security/advisory/2017-02-01/  (see SECURITY-383 / CVE-2017-2608)",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHDM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-26259"
        },
        {
          "category": "external",
          "summary": "RHBZ#1908837",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1908837"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-26259",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-26259"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-26259",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26259"
        }
      ],
      "release_date": "2020-12-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:15:14+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHDM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2476"
        },
        {
          "category": "workaround",
          "details": "As recommended, use XStream\u0027s security framework to implement a whitelist for the allowed types.\n\nUsers of XStream 1.4.14 who insist to use XStream default blacklist - despite that clear recommendation - can simply add two lines to XStream\u0027s setup code:\n\nxstream.denyTypes(new String[]{ \"jdk.nashorn.internal.objects.NativeString\" });\nxstream.denyTypesByRegExp(new String[]{ \".*\\\\.ReadAllStream\\\\$FileStream\" });\n\nUsers of XStream 1.4.13 who want to use XStream default blacklist can simply add three lines to XStream\u0027s setup code:\n\nxstream.denyTypes(new String[]{ \"javax.imageio.ImageIO$ContainsFilter\", \"jdk.nashorn.internal.objects.NativeString\" });\nxstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class });\nxstream.denyTypesByRegExp(new String[]{ \".*\\\\.ReadAllStream\\\\$FileStream\" });\n\nUsers of XStream 1.4.12 to 1.4.7 who want to use XStream with a blacklist will have to setup such a list from scratch and deny at least the following types: javax.imageio.ImageIO$ContainsFilter, java.beans.EventHandler, java.lang.ProcessBuilder, jdk.nashorn.internal.objects.NativeString, java.lang.Void and void and deny several types by name pattern.\n\nxstream.denyTypes(new String[]{ \"javax.imageio.ImageIO$ContainsFilter\", \"jdk.nashorn.internal.objects.NativeString\" });\nxstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class });\nxstream.denyTypesByRegExp(new String[]{ \".*\\\\$LazyIterator\", \"javax\\\\.crypto\\\\..*\", \".*\\\\.ReadAllStream\\\\$FileStream\" });\n\nUsers of XStream 1.4.6 or below can register an own converter to prevent the unmarshalling of the currently know critical types of the Java runtime. It is in fact an updated version of the workaround for CVE-2013-7285:\n\nxstream.registerConverter(new Converter() {\n  public boolean canConvert(Class type) {\n    return type != null \u0026\u0026 (type == java.beans.EventHandler.class || type == java.lang.ProcessBuilder.class\n        || type.getName().equals(\"javax.imageio.ImageIO$ContainsFilter\") || type.getName().equals(\"jdk.nashorn.internal.objects.NativeString\")\n        || type == java.lang.Void.class || void.class || Proxy.isProxy(type)\n        || type.getName().startsWith(\"javax.crypto.\") || type.getName().endsWith(\"$LazyIterator\") || type.getName().endsWith(\".ReadAllStream$FileStream\"));\n  }\n\n  public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) {\n    throw new ConversionException(\"Unsupported type due to security reasons.\");\n  }\n\n  public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) {\n    throw new ConversionException(\"Unsupported type due to security reasons.\");\n  }\n}, XStream.PRIORITY_LOW);",
          "product_ids": [
            "RHDM 7.11.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "RHDM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "XStream: arbitrary file deletion on the local host when unmarshalling"
    },
    {
      "cve": "CVE-2021-21341",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2021-03-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1942539"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: allow a remote attacker to cause DoS only by manipulating the processed input stream",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHDM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-21341"
        },
        {
          "category": "external",
          "summary": "RHBZ#1942539",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942539"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-21341",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21341"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-21341",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21341"
        }
      ],
      "release_date": "2021-03-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:15:14+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHDM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2476"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "RHDM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "XStream: allow a remote attacker to cause DoS only by manipulating the processed input stream"
    },
    {
      "cve": "CVE-2021-21342",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2021-03-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1942545"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: SSRF via crafted input stream",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHDM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-21342"
        },
        {
          "category": "external",
          "summary": "RHBZ#1942545",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942545"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-21342",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21342"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-21342",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21342"
        }
      ],
      "release_date": "2021-03-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:15:14+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHDM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2476"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "RHDM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "XStream: SSRF via crafted input stream"
    },
    {
      "cve": "CVE-2021-21343",
      "cwe": {
        "id": "CWE-552",
        "name": "Files or Directories Accessible to External Parties"
      },
      "discovery_date": "2021-03-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1942550"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in the deletion of a file on the local host. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: arbitrary file deletion on the local host via crafted input stream",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHDM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-21343"
        },
        {
          "category": "external",
          "summary": "RHBZ#1942550",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942550"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-21343",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21343"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-21343",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21343"
        }
      ],
      "release_date": "2021-03-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:15:14+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHDM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2476"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "RHDM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "XStream: arbitrary file deletion on the local host via crafted input stream"
    },
    {
      "cve": "CVE-2021-21344",
      "cwe": {
        "id": "CWE-434",
        "name": "Unrestricted Upload of File with Dangerous Type"
      },
      "discovery_date": "2021-03-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1942554"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xstream. A remote attacker may be able to load and execute arbitrary code from a remote host only by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: Unsafe deserizaliation of javax.sql.rowset.BaseRowSet",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHDM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-21344"
        },
        {
          "category": "external",
          "summary": "RHBZ#1942554",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942554"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-21344",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21344"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-21344",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21344"
        }
      ],
      "release_date": "2021-03-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:15:14+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHDM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2476"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "RHDM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "XStream: Unsafe deserizaliation of javax.sql.rowset.BaseRowSet"
    },
    {
      "cve": "CVE-2021-21345",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2021-03-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1942558"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xstream. A remote attacker, who has sufficient rights, can execute commands of the host by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: Unsafe deserizaliation of com.sun.corba.se.impl.activation.ServerTableEntry",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHDM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-21345"
        },
        {
          "category": "external",
          "summary": "RHBZ#1942558",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942558"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-21345",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21345"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-21345",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21345"
        }
      ],
      "release_date": "2021-03-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:15:14+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHDM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2476"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "RHDM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "XStream: Unsafe deserizaliation of com.sun.corba.se.impl.activation.ServerTableEntry"
    },
    {
      "cve": "CVE-2021-21346",
      "cwe": {
        "id": "CWE-434",
        "name": "Unrestricted Upload of File with Dangerous Type"
      },
      "discovery_date": "2021-03-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1942578"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xstream. A remote attacker can load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: Unsafe deserizaliation of sun.swing.SwingLazyValue",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHDM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-21346"
        },
        {
          "category": "external",
          "summary": "RHBZ#1942578",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942578"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-21346",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21346"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-21346",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21346"
        }
      ],
      "release_date": "2021-03-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:15:14+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHDM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2476"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "RHDM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "XStream: Unsafe deserizaliation of sun.swing.SwingLazyValue"
    },
    {
      "cve": "CVE-2021-21347",
      "cwe": {
        "id": "CWE-434",
        "name": "Unrestricted Upload of File with Dangerous Type"
      },
      "discovery_date": "2021-03-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1942629"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xstream. A remote attacker may be able to load and execute arbitrary code from a remote host only by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHDM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-21347"
        },
        {
          "category": "external",
          "summary": "RHBZ#1942629",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942629"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-21347",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21347"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-21347",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21347"
        }
      ],
      "release_date": "2021-03-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:15:14+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHDM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2476"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "RHDM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator"
    },
    {
      "cve": "CVE-2021-21348",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2021-03-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1942633"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: ReDoS vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHDM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-21348"
        },
        {
          "category": "external",
          "summary": "RHBZ#1942633",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942633"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-21348",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21348"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-21348",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21348"
        }
      ],
      "release_date": "2021-03-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:15:14+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHDM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2476"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "RHDM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "XStream: ReDoS vulnerability"
    },
    {
      "cve": "CVE-2021-21349",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2021-03-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1942635"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHDM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-21349"
        },
        {
          "category": "external",
          "summary": "RHBZ#1942635",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942635"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-21349",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21349"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-21349",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21349"
        }
      ],
      "release_date": "2021-03-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:15:14+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHDM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2476"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "RHDM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host"
    },
    {
      "cve": "CVE-2021-21350",
      "cwe": {
        "id": "CWE-434",
        "name": "Unrestricted Upload of File with Dangerous Type"
      },
      "discovery_date": "2021-03-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1942637"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xstream. A remote attacker may be able to execute arbitrary code only by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: Unsafe deserizaliation of com.sun.org.apache.bcel.internal.util.ClassLoader",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHDM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-21350"
        },
        {
          "category": "external",
          "summary": "RHBZ#1942637",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942637"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-21350",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21350"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-21350",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21350"
        }
      ],
      "release_date": "2021-03-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:15:14+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHDM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2476"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "RHDM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "XStream: Unsafe deserizaliation of com.sun.org.apache.bcel.internal.util.ClassLoader"
    },
    {
      "cve": "CVE-2021-21351",
      "cwe": {
        "id": "CWE-434",
        "name": "Unrestricted Upload of File with Dangerous Type"
      },
      "discovery_date": "2021-03-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1942642"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHDM 7.11.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-21351"
        },
        {
          "category": "external",
          "summary": "RHBZ#1942642",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942642"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-21351",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21351"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-21351",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21351"
        }
      ],
      "release_date": "2021-03-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-17T13:15:14+00:00",
          "details": "For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHDM 7.11.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2476"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "RHDM 7.11.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for jackson-databind",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for jackson-databind fixes the following issues:\n\njackson-databind was updated to 2.10.5.1:\n  * #2589: `DOMDeserializer`: setExpandEntityReferences(false) may\n    not prevent external entity expansion in all cases\n    (CVE-2020-25649, bsc#1177616)\n  * #2787 (partial fix): NPE after add mixin for enum\n  * #2679: \u0027ObjectMapper.readValue(\u0027123\u0027, Void.TYPE)\u0027 throws\n    \u0027should never occur\u0027\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2021-243,SUSE-SLE-Module-Development-Tools-15-SP2-2021-243",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2021_0243-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2021:0243-1",
        "url": "https://www.suse.com/support/update/announcement/2021/suse-su-20210243-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2021:0243-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-January/008253.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177616",
        "url": "https://bugzilla.suse.com/1177616"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1180391",
        "url": "https://bugzilla.suse.com/1180391"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1181118",
        "url": "https://bugzilla.suse.com/1181118"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-25649 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-25649/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-35728 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-35728/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-20190 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-20190/"
      }
    ],
    "title": "Security update for jackson-databind",
    "tracking": {
      "current_release_date": "2021-01-29T08:37:34Z",
      "generator": {
        "date": "2021-01-29T08:37:34Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2021:0243-1",
      "initial_release_date": "2021-01-29T08:37:34Z",
      "revision_history": [
        {
          "date": "2021-01-29T08:37:34Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jackson-databind-2.10.5.1-3.3.2.noarch",
                "product": {
                  "name": "jackson-databind-2.10.5.1-3.3.2.noarch",
                  "product_id": "jackson-databind-2.10.5.1-3.3.2.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jackson-databind-javadoc-2.10.5.1-3.3.2.noarch",
                "product": {
                  "name": "jackson-databind-javadoc-2.10.5.1-3.3.2.noarch",
                  "product_id": "jackson-databind-javadoc-2.10.5.1-3.3.2.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Development Tools 15 SP2",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Development Tools 15 SP2",
                  "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-development-tools:15:sp2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-databind-2.10.5.1-3.3.2.noarch as component of SUSE Linux Enterprise Module for Development Tools 15 SP2",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP2:jackson-databind-2.10.5.1-3.3.2.noarch"
        },
        "product_reference": "jackson-databind-2.10.5.1-3.3.2.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-25649",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-25649"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Development Tools 15 SP2:jackson-databind-2.10.5.1-3.3.2.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-25649",
          "url": "https://www.suse.com/security/cve/CVE-2020-25649"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1177616 for CVE-2020-25649",
          "url": "https://bugzilla.suse.com/1177616"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Development Tools 15 SP2:jackson-databind-2.10.5.1-3.3.2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Development Tools 15 SP2:jackson-databind-2.10.5.1-3.3.2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-29T08:37:34Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-25649"
    },
    {
      "cve": "CVE-2020-35728",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-35728"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Development Tools 15 SP2:jackson-databind-2.10.5.1-3.3.2.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-35728",
          "url": "https://www.suse.com/security/cve/CVE-2020-35728"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1180391 for CVE-2020-35728",
          "url": "https://bugzilla.suse.com/1180391"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Development Tools 15 SP2:jackson-databind-2.10.5.1-3.3.2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Development Tools 15 SP2:jackson-databind-2.10.5.1-3.3.2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-29T08:37:34Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-35728"
    },
    {
      "cve": "CVE-2021-20190",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-20190"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Development Tools 15 SP2:jackson-databind-2.10.5.1-3.3.2.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-20190",
          "url": "https://www.suse.com/security/cve/CVE-2021-20190"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1181118 for CVE-2021-20190",
          "url": "https://bugzilla.suse.com/1181118"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Development Tools 15 SP2:jackson-databind-2.10.5.1-3.3.2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Development Tools 15 SP2:jackson-databind-2.10.5.1-3.3.2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-29T08:37:34Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-20190"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2020-36518: Fixed a Java stack overflow exception and denial of service via a large depth of nested objects in jackson-databind. (bsc#1197132)\n- CVE-2020-25649: Fixed an insecure entity expansion in jackson-databind which was vulnerable to XML external entity (XXE). (bsc#1177616)\n- CVE-2020-28491: Fixed a bug which could cause `java.lang.OutOfMemoryError` exception in jackson-dataformats-binary. (bsc#1182481)\n\nNon security fixes:\n\njackson-annotations - update from version 2.10.2 to version 2.13.0:\n\n   + Build with source/target levels 8\n   + Add \u0027mvnw\u0027 wrapper\n   + \u0027JsonSubType.Type\u0027 should accept array of names\n   + Jackson version alignment with Gradle 6\n   + Add \u0027@JsonIncludeProperties\u0027\n   + Add \u0027@JsonTypeInfo(use=DEDUCTION)\u0027\n   + Ability to use \u0027@JsonAnyGetter\u0027 on fields\n   + Add \u0027@JsonKey\u0027 annotation\n   + Allow repeated calls to \u0027SimpleObjectIdResolver.bindItem()\u0027 for same mapping\n   + Add \u0027namespace\u0027 property for \u0027@JsonProperty\u0027 (for XML module)\n   + Add target \u0027ElementType.ANNOTATION_TYPE\u0027 for \u0027@JsonEnumDefaultValue\u0027\n   + \u0027JsonPattern.Value.pattern\u0027 retained as \u0027\u0027, never (accidentally) exposed as \u0027null\u0027\n   + Rewrite to use `ant` for building in order to be able to use it in packages that have to be built before maven\n\njackson-bom - update from version 2.10.2 to version 2.13.0:\n\n   + Configure moditect plugin with \u0027\u003cjvmVersion\u003e11\u003c/jvmVersion\u003e\u0027\n   + jackson-bom manages the version of \u0027junit:junit\u0027\n   + Drop \u0027jackson-datatype-hibernate3\u0027 (support for Hibernate 3.x datatypes)\n   + Removed \u0027jakarta\u0027 classifier variants of JAXB/JSON-P/JAX-RS modules due to the addition of new Jakarta artifacts\n     (Jakarta-JSONP, Jakarta-xmlbind-annotations, Jakarta-rs-providers)\n   + Add version for \u0027jackson-datatype-jakarta-jsonp\u0027 module (introduced after 2.12.2)\n   + Add (beta) version for \u0027jackson-dataformat-toml\u0027\n   + Jakarta 9 artifact versions are missing from jackson-bom\n   + Add default settings for \u0027gradle-module-metadata-maven-plugin\u0027 (gradle metadata)\n   + Add default settings for \u0027build-helper-maven-plugin\u0027\n   + Drop \u0027jackson-module-scala_2.10\u0027 entry (not released for Jackson 2.12 or later)\n   + Add override for \u0027version.plugin.bundle\u0027 (for 5.1.1) to help build on JDK 15+\n   + Add missing version for jackson-datatype-eclipse-collections\n    \njackson-core - update from version 2.10.2 to version 2.13.0:\n\n   + Build with source and target levels 8\n   + Misleading exception for input source when processing byte buffer with start offset\n   + Escape contents of source document snippet for \u0027JsonLocation._appendSourceDesc()\u0027\n   + Add \u0027StreamWriteException\u0027 type to eventually replace \u0027JsonGenerationException\u0027\n   + Replace \u0027getCurrentLocation()\u0027/\u0027getTokenLocation()\u0027 with \u0027currentLocation()\u0027/\u0027currentTokenLocation()\u0027 in \n     \u0027JsonParser\u0027\n   + Replace \u0027JsonGenerator.writeObject()\u0027 (and related) with \u0027writePOJO()\u0027\n   + Replace \u0027getCurrentValue()\u0027/\u0027setCurrentValue()\u0027 with \u0027currentValue()\u0027/\u0027assignCurrentValue()\u0027 in \n     \u0027JsonParser\u0027/\u0027JsonGenerator\n   + Introduce O(n^1.5) BigDecimal parser implementation\n   + ByteQuadsCanonicalizer.addName(String, int, int) has incorrect handling for case of q2 == null\n   + UTF32Reader ArrayIndexOutOfBoundsException\n   + Improve exception/JsonLocation handling for binary content: don\u0027t show content, include byte offset\n   + Fix an issue with the TokenFilter unable to ignore properties when deserializing.\n   + Optimize array allocation by \u0027JsonStringEncoder\u0027\n   + Add \u0027mvnw\u0027 wrapper\n   + (partial) Optimize array allocation by \u0027JsonStringEncoder\u0027\n   + Add back accidentally removed \u0027JsonStringEncoder\u0027 related methods in \u0027BufferRecyclers\u0027 \n     (like \u0027getJsonStringEncoder()\u0027)\n   + \u0027ArrayOutOfBoundException\u0027 at \u0027WriterBasedJsonGenerator.writeString(Reader, int)\u0027\n   + Allow \u0027optional-padding\u0027 for \u0027Base64Variant\u0027\n   + More customizable TokenFilter inclusion (using \u0027Tokenfilter.Inclusion\u0027)\n   + Publish Gradle Module Metadata\n   + Add \u0027StreamReadCapability\u0027 for further format-based/format-agnostic handling improvements\n   + Add \u0027JsonParser.isExpectedNumberIntToken()\u0027 convenience method\n   + Add \u0027StreamWriteCapability\u0027 for further format-based/format-agnostic handling improvements\n   + Add \u0027JsonParser.getNumberValueExact()\u0027 to allow precision-retaining buffering\n   + Limit initial allocated block size by \u0027ByteArrayBuilder\u0027 to max block size\n   + Add \u0027JacksonException\u0027 as parent class of \u0027JsonProcessingException\u0027\n   + Make \u0027JsonWriteContext.reset()\u0027 and \u0027JsonReadContext.reset()\u0027 methods public\n   + Deprecate \u0027JsonParser.getCurrentTokenId()\u0027 (use \u0027#currentTokenId()\u0027 instead)\n   + Full \u0027LICENSE\u0027 included in jar for easier access by compliancy tools\n   + Fix NPE in \u0027writeNumber(String)\u0027 method of \u0027UTF8JsonGenerator\u0027, \u0027WriterBasedJsonGenerator\u0027\n   + Add a String Array write method in the Streaming API\n   + Synchronize variants of \u0027JsonGenerator#writeNumberField\u0027 with \u0027JsonGenerator#writeNumber\u0027\n   + Add JsonGenerator#writeNumber(char[], int, int) method\n   + Do not clear aggregated contents of \u0027TextBuffer\u0027 when \u0027releaseBuffers()\u0027 called\n   + \u0027FilteringGeneratorDelegate\u0027 does not handle \u0027writeString(Reader, int)\u0027\n   + Optionally allow leading decimal in float tokens\n   + Rewrite to use ant for building in order to be able to use it in packages that have to be built before maven\n   + Parsing JSON with \u0027ALLOW_MISSING_VALUE\u0027 enabled results in endless stream of \u0027VALUE_NULL\u0027 tokens\n   + Handle case when system property access is restricted\n   + \u0027FilteringGeneratorDelegate\u0027 does not handle \u0027writeString(Reader, int)\u0027\n   + DataFormatMatcher#getMatchedFormatName throws NPE when no match exists\n   + \u0027JsonParser.getCurrentLocation()\u0027 byte/char offset update incorrectly for big payloads \n\njackson-databind - update from version 2.10.5.1 to  version 2.13.0:\n\n   + \u0027@JsonValue\u0027 with integer for enum does not deserialize correctly\n   + \u0027AnnotatedMethod.getValue()/setValue()\u0027 doesn\u0027t have useful exception message\n   + Add \u0027DatabindException\u0027 as intermediate subtype of \u0027JsonMappingException\u0027\n   + Jackson does not support deserializing new Java 9 unmodifiable collections\n   + Allocate TokenBuffer instance via context objects (to\n      allow format-specific buffer types)\n   + Add mechanism for setting default \u0027ContextAttributes\u0027 for \u0027ObjectMapper\u0027\n   + Add \u0027DeserializationContext.readTreeAsValue()\u0027 methods\n      for more convenient conversions for deserializers to use\n   + Clean up support of typed \u0027unmodifiable\u0027, \u0027singleton\u0027\n      Maps/Sets/Collections\n   + Extend internal bitfield of \u0027MapperFeature\u0027 to be\n      \u0027long\u0027\n   + Add \u0027removeMixIn()\u0027 method in \u0027MapperBuilder\u0027\n   + Backport \u0027MapperBuilder\u0027 lambda-taking methods:\n      \u0027withConfigOverride()\u0027, \u0027withCoercionConfig()\u0027,\n      \u0027withCoercionConfigDefaults()\u0027\n   + configOverrides(boolean.class) silently ignored,\n      whereas .configOverride(Boolean.class) works for both\n      primitives and boxed boolean values\n   + Dont track unknown props in buffer if\n      \u0027ignoreAllUnknown\u0027 is true\n   + Should allow deserialization of java.time types via\n      opaque \u0027JsonToken.VALUE_EMBEDDED_OBJECT\u0027\n   + Optimize \u0027AnnotatedConstructor.call()\u0027 case by passing\n      explicit null\n   + Add AnnotationIntrospector.XmlExtensions interface for\n      decoupling javax dependencies\n   + Custom SimpleModule not included in list returned by\n      ObjectMapper.getRegisteredModuleIds() after registration\n   + Use more limiting default visibility settings for JDK\n      types (java.*, javax.*)\n   + Deep merge for \u0027JsonNode\u0027 using \u0027ObjectReader.readTree()\u0027\n   + IllegalArgumentException: Conflicting setter\n      definitions for property with more than 2 setters\n   + Serializing java.lang.Thread fails on JDK 11 and above\n   + String-based \u0027Map\u0027 key deserializer is not\n      deterministic when there is no single arg constructor\n   + Add ArrayNode#set(int index, primitive_type value)\n   + JsonStreamContext \u0027currentValue\u0027 wrongly references to\n      \u0027@JsonTypeInfo\u0027 annotated object\n   + DOM \u0027Node\u0027 serialization omits the default namespace\n      declaration\n   + Support \u0027suppressed\u0027 property when deserializing \u0027Throwable\u0027\n   + \u0027AnnotatedMember.equals()\u0027 does not work reliably\n   + Add \u0027MapperFeature.APPLY_DEFAULT_VALUES\u0027, initially for Scala module\n   + For an absent property Jackson injects \u0027NullNode\u0027\n      instead of \u0027null\u0027 to a JsonNode-typed constructor argument of\n      a \u0027@ConstructorProperties\u0027-annotated constructor\n   + \u0027XMLGregorianCalendar\u0027 doesn\u0027t work with default typing\n   + Content \u0027null\u0027 handling not working for root values\n   + StdDeserializer rejects blank (all-whitespace) strings\n      for ints\n   + \u0027USE_BASE_TYPE_AS_DEFAULT_IMPL\u0027 not working with\n      \u0027DefaultTypeResolverBuilder\u0027\n   + Add PropertyNamingStrategies.UpperSnakeCaseStrategy\n      (and UPPER_SNAKE_CASE constant)\n   + StackOverflowError when serializing JsonProcessingException\n   + Support for BCP 47 \u0027java.util.Locale\u0027 serialization/deserialization\n   + String property deserializes null as \u0027null\u0027 for\n      JsonTypeInfo.As.EXISTING_PROPERTY\n   + Can not deserialize json to enum value with\n      Object-/Array-valued input, \u0027@JsonCreator\u0027\n   + Fix to avoid problem with \u0027BigDecimalNode\u0027, scale of\n      \u0027Integer.MIN_VALUE\u0027\n   + Extend handling of \u0027FAIL_ON_NULL_FOR_PRIMITIVES\u0027 to cover\n      coercion from (Empty) String via \u0027AsNull\u0027\n   + Add \u0027mvnw\u0027 wrapper\n   + (regression) Factory method generic type resolution\n      does not use Class-bound type parameter\n   + Deserialization of \u0027empty\u0027 subtype with DEDUCTION failed\n   + Merge findInjectableValues() results in\n      AnnotationIntrospectorPair\n   + READ_UNKNOWN_ENUM_VALUES_USING_DEFAULT_VALUE doesn\u0027t\n      work with empty strings\n   + \u0027TypeFactory\u0027 cannot convert \u0027Collection\u0027 sub-type\n      without type parameters to canonical form and back\n    + Fix for [modules-java8#207]: prevent fail on secondary Java 8\n      date/time types\n   + EXTERNAL_PROPERTY does not work well with \u0027@JsonCreator\u0027\n      and \u0027FAIL_ON_UNKNOWN_PROPERTIES\u0027\n   + String property deserializes null as \u0027null\u0027 for\n     \u0027JsonTypeInfo.As.EXTERNAL_PROPERTY\u0027\n   + Property ignorals cause \u0027BeanDeserializer \u0027to forget\n      how to read from arrays (not copying\n      \u0027_arrayDelegateDeserializer\u0027)\n   + UntypedObjectDeserializer\u0027 mixes multiple unwrapped\n      collections (related to #2733)\n   + Two cases of incorrect error reporting about\n      DeserializationFeature\n   + Bug in polymorphic deserialization with \u0027@JsonCreator\u0027,\n      \u0027@JsonAnySetter\u0027, \u0027JsonTypeInfo.As.EXTERNAL_PROPERTY\u0027\n   + Polymorphic subtype deduction ignores \u0027defaultImpl\u0027\n      attribute\n   + MismatchedInputException: Cannot deserialize instance\n      of \u0027com.fasterxml.jackson.databind.node.ObjectNode\u0027 out of\n      VALUE_NULL token\n   + Missing override for \u0027hasAsKey()\u0027 in\n      \u0027AnnotationIntrospectorPair\u0027\n   + Creator lookup fails with \u0027InvalidDefinitionException\u0027\n      for conflict between single-double/single-Double arg constructor\n   + \u0027MapDeserializer\u0027 forcing \u0027JsonMappingException\u0027\n      wrapping even if WRAP_EXCEPTIONS set to false\n   + Auto-detection of constructor-based creator method\n      skipped if there is an annotated factory-based creator method\n      (regression from 2.11)\n   + \u0027ObjectMapper.treeToValue()\u0027 no longer invokes\n      \u0027JsonDeserializer.getNullValue()\u0027\n   + DeserializationProblemHandler is not invoked when\n      trying to deserialize String\n   + Fix failing \u0027double\u0027 JsonCreators in jackson 2.12.0\n   + Conflicting in POJOPropertiesCollector when having\n      namingStrategy\n   + Breaking API change in \u0027BasicClassIntrospector\u0027 (2.12.0)\n   + \u0027JsonNode.requiredAt()\u0027 does NOT fail on some path expressions\n   + Exception thrown when \u0027Collections.synchronizedList()\u0027\n      is serialized with type info, deserialized\n   + Add option to resolve type from multiple existing\n      properties, \u0027@JsonTypeInfo(use=DEDUCTION)\u0027\n   + \u0027@JsonIgnoreProperties\u0027 does not prevent Exception\n      Conflicting getter/setter definitions for property\n   + Deserialization Not Working Right with Generic Types and\n      Builders\n   + Add \u0027@JsonIncludeProperties(propertyNames)\u0027 (reverse of\n      \u0027@JsonIgnoreProperties\u0027)\n   + \u0027@JsonAnyGetter\u0027 should be allowed on a field\n   + Allow handling of single-arg constructor as property\n      based by default\n   + Allow case insensitive deserialization of String value\n      into \u0027boolean\u0027/\u0027Boolean\u0027 (esp for Excel)\n   + Allow use of \u0027@JsonFormat(with=JsonFormat.Feature\n      .ACCEPT_CASE_INSENSITIVE_PROPERTIES)\u0027 on Class\n   + Abstract class included as part of known type ids for\n      error message   when using JsonSubTypes\n   + Distinguish null from empty string for UUID\n      deserialization\n   + \u0027ReferenceType\u0027 does not expose valid containedType\n   + Add \u0027CoercionConfig[s]\u0027 mechanism for configuring\n      allowed coercions\n   + \u0027JsonProperty.Access.READ_ONLY\u0027 does not work with\n      \u0027getter-as-setter\u0027 \u0027Collection\u0027s\n   + Support \u0027BigInteger\u0027 and \u0027BigDecimal\u0027 creators in\n      \u0027StdValueInstantiator\u0027\n   + \u0027JsonProperty.Access.READ_ONLY\u0027 fails with collections\n      when a property name is specified\n   + \u0027BigDecimal\u0027 precision not retained for polymorphic\n      deserialization\n   + Support use of \u0027Void\u0027 valued properties\n      (\u0027MapperFeature.ALLOW_VOID_VALUED_PROPERTIES\u0027)\n   + Explicitly fail (de)serialization of \u0027java.time.*\u0027\n      types in absence of registered custom (de)serializers\n   + Improve description included in by\n      \u0027DeserializationContext.handleUnexpectedToken()\u0027\n   + Support for JDK 14 record types (\u0027java.lang.Record\u0027)\n   + \u0027PropertyNamingStrategy\u0027 class initialization depends\n      on its subclass, this can lead to class loading deadlock\n   + \u0027FAIL_ON_IGNORED_PROPERTIES\u0027 does not throw on\n      \u0027READONLY\u0027 properties with an explicit name\n   + Add Gradle Module Metadata for version alignment with\n      Gradle 6\n   + Allow \u0027JsonNode\u0027 auto-convert into \u0027ArrayNode\u0027 if\n      duplicates found (for XML)\n   + Allow values of \u0027untyped\u0027 auto-convert into \u0027List\u0027 if\n      duplicates found (for XML)\n   + Add \u0027ValueInstantiator.createContextual(...)\n   + Support multiple names in \u0027JsonSubType.Type\u0027\n   + Disabling \u0027FAIL_ON_INVALID_SUBTYPE\u0027 breaks polymorphic\n      deserialization of Enums\n   + Explicitly fail (de)serialization of \u0027org.joda.time.*\u0027\n      types in absence of registered custom (de)serializers\n   + Trailing zeros are stripped when deserializing\n      BigDecimal values inside a @JsonUnwrapped property\n   + Extract getter/setter/field name mangling from\n      \u0027BeanUtil\u0027 into pluggable \u0027AccessorNamingStrategy\u0027\n   + Throw \u0027InvalidFormatException\u0027 instead of\n      \u0027MismatchedInputException\u0027 for ACCEPT_FLOAT_AS_INT coercion\n      failures\n   + Add \u0027@JsonKey\u0027 annotation (similar to \u0027@JsonValue\u0027) for\n      customizable serialization of Map keys\n   + \u0027MapperFeature.ACCEPT_CASE_INSENSITIVE_ENUMS\u0027 should\n      work for enum as keys\n   + Add support for disabling special handling of \u0027Creator\n      properties\u0027 wrt alphabetic property ordering\n   + Add \u0027JsonNode.canConvertToExactIntegral()\u0027 to indicate\n      whether floating-point/BigDecimal values could be converted to\n      integers losslessly\n   + Improve static factory method generic type resolution\n      logic\n   + Allow preventing \u0027Enum from integer\u0027 coercion using new\n      \u0027CoercionConfig\u0027 system\n   + \u0027@JsonValue\u0027 not considered when evaluating inclusion\n   + Make some java platform modules optional\n   + Add support for serializing \u0027java.sql.Blob\u0027\n   + \u0027AnnotatedCreatorCollector\u0027 should avoid processing\n      synthetic static (factory) methods\n   + Add errorprone static analysis profile to detect bugs at build time\n   + Problem with implicit creator name detection for constructor detection\n   + Add \u0027BeanDeserializerBase.isCaseInsensitive()\u0027\n   + Refactoring of \u0027CollectionDeserializer\u0027 to solve CSV array handling issues\n   + Full \u0027LICENSE\u0027 included in jar for easier access by compliancy tools\n   + Fix type resolution for static methods (regression in 2.11.3)\n   + \u0027@JsonCreator\u0027 on constructor not compatible with \u0027@JsonIdentityInfo\u0027, \n     \u0027PropertyGenerator\u0027\n   + Add debug improvements about \u0027ClassUtil.getClassMethods()\u0027\n   + Cannot detect creator arguments of mixins for JDK types\n   + Add \u0027JsonFormat.Shape\u0027 awareness for UUID serialization (\u0027UUIDSerializer\u0027)\n   + Json serialization fails or a specific case that\n      contains generics and static methods with generic parameters\n      (2.11.1 -\u003e 2.11.2 regression)\n   + \u0027ObjectMapper.activateDefaultTypingAsProperty()\u0027 is not\n      using parameter \u0027PolymorphicTypeValidator\u0027\n   + Problem deserialization \u0027raw generic\u0027 fields\n      (like \u0027Map\u0027) in 2.11.2\n   + Fix issues with \u0027MapLikeType.isTrueMapType()\u0027,\n      \u0027CollectionLikeType.isTrueCollectionType()\u0027\n   + Parser/Generator features not set when using\n      \u0027ObjectMapper.createParser()\u0027, \u0027createGenerator()\u0027\n   + Polymorphic subtypes not registering on copied\n      ObjectMapper (2.11.1)\n   + Failure to read AnnotatedField value in Jackson 2.11\n   + \u0027TypeFactory.constructType()\u0027 does not take\n      \u0027TypeBindings\u0027 correctly\n   + Builder Deserialization with JsonCreator Value vs Array\n   + JsonCreator on static method in Enum and Enum used as\n      key in map fails randomly\n   + \u0027StdSubtypeResolver\u0027 is not thread safe (possibly due\n      to copy not being made with \u0027ObjectMapper.copy()\u0027)\n   + \u0027Conflicting setter definitions for property\u0027 exception\n      for \u0027Map\u0027 subtype during deserialization\n   + Fail to deserialize local Records\n   + Rearranging of props when property-based generator is\n      in use leads to incorrect output\n   + Jackson doesn\u0027t respect\n      \u0027CAN_OVERRIDE_ACCESS_MODIFIERS=false\u0027 for deserializer\n      properties\n   + \u0027DeserializationFeature.UNWRAP_SINGLE_VALUE_ARRAYS\u0027\n      don\u0027t support \u0027Map\u0027 type field\n   + JsonParser from MismatchedInputException cannot\n      getText() for floating-point value\n   + i-I case conversion problem in Turkish locale with\n      case-insensitive deserialization\n   + \u0027@JsonInject\u0027 fails on trying to find deserializer even\n      if inject-only\n   + Polymorphic deserialization should handle\n      case-insensitive Type Id property name if\n      \u0027MapperFeature.ACCEPT_CASE_INSENSITIVE_PROPERTIES\u0027 is enabled\n   + TreeTraversingParser and UTF8StreamJsonParser create\n      contexts differently\n   + Support use of \u0027@JsonAlias\u0027 for enum values\n   + \u0027declaringClass\u0027 of \u0027enum-as-POJO\u0027 not removed for\n      \u0027ObjectMapper\u0027 with a naming strategy\n   + Fix \u0027JavaType.isEnumType()\u0027 to support sub-classes\n   + BeanDeserializerBuilder Protected Factory Method for Extension\n   + Support \u0027@JsonSerialize(keyUsing)\u0027 and\n      \u0027@JsonDeserialize(keyUsing)\u0027 on Key class\n   + Add \u0027SerializationFeature.WRITE_SELF_REFERENCES_AS_NULL\u0027\n   + \u0027ObjectMapper.registerSubtypes(NamedType...)\u0027 doesn\u0027t\n      allow registering same POJO for two different type ids\n   + \u0027DeserializationContext.handleMissingInstantiator()\u0027\n      throws \u0027MismatchedInputException\u0027 for non-static inner classes\n   + Incorrect \u0027JsonStreamContext\u0027 for \u0027TokenBuffer\u0027 and\n      \u0027TreeTraversingParser\u0027\n   + Add \u0027AnnotationIntrospector.findRenameByField()\u0027 to\n      support Kotlin\u0027s \u0027is-getter\u0027 naming convention\n   + Use \u0027@JsonProperty(index)\u0027 for sorting properties on\n      serialization\n   + Java 8 \u0027Optional\u0027 not working with \u0027@JsonUnwrapped\u0027 on\n      unwrappable type\n   + Add \u0027MapperFeature.BLOCK_UNSAFE_POLYMORPHIC_BASE_TYPES\u0027\n      to allow blocking use of unsafe base type for polymorphic\n      deserialization\n   + \u0027ObjectMapper.setSerializationInclusion()\u0027 is ignored\n      for \u0027JsonAnyGetter\u0027\n   + \u0027ValueInstantiationException\u0027 when deserializing using\n      a builder and \u0027UNWRAP_SINGLE_VALUE_ARRAYS\u0027\n   + JsonIgnoreProperties(ignoreUnknown = true) does not\n      work on field and method level\n   + Failure to resolve generic type parameters on\n      serialization\n   + JsonParser cannot getText() for input stream on\n      MismatchedInputException\n   + ObjectReader readValue lacks Class\u003cT\u003e argument\n   + Change default textual serialization of\n      \u0027java.util.Date\u0027/\u0027Calendar\u0027 to include colon in timezone\n      offset\n   + Add \u0027ObjectMapper.createParser()\u0027 and \u0027createGenerator()\u0027 methods\n   + Allow serialization of \u0027Properties\u0027 with non-String values\n   + Add new factory method for creating custom \u0027EnumValues\u0027\n      to pass to \u0027EnumDeserializer\n   + \u0027IllegalArgumentException\u0027 thrown for mismatched\n      subclass deserialization\n   + Add convenience methods for creating \u0027List\u0027, \u0027Map\u0027\n      valued \u0027ObjectReader\u0027s (ObjectMapper.readerForListOf())\n   + \u0027SerializerProvider.findContentValueSerializer()\u0027 methods\n    \njackson-dataformats-binary - update from version 2.10.1 to version 2.13.0:\n    \n   + (cbor) Should validate UTF-8 multi-byte validity for short decode path too\n   + (ion) Deprecate \u0027CloseSafeUTF8Writer\u0027, remove use\n   + (smile) Make \u0027SmileFactory\u0027 support \u0027JsonFactory.Feature.CANONICALIZE_FIELD_NAMES\u0027\n   + (cbor) Make \u0027CBORFactory\u0027 support \u0027JsonFactory.Feature.CANONICALIZE_FIELD_NAMES\u0027\n   + (cbor) Handle case of BigDecimal with Integer.MIN_VALUE for scale gracefully\n   + (cbor) Uncaught exception in CBORParser._nextChunkedByte2 (by ossfuzzer)\n   + (cbor) Another uncaught exception in CBORParser._nextChunkedByte2 (by ossfuzzer)\n   + (smile) Add \u0027SmileGenerator.Feature.LENIENT_UTF_ENCODING\u0027 for lenient\n     handling of broken Unicode surrogate pairs on writing\n   + (avro) Add \u0027logicalType\u0027 support for some \u0027java.time\u0027 types; add \u0027AvroJavaTimeModule\u0027\n     for native ser/deser\n   + Support base64 strings in \u0027getBinaryValue()\u0027 for CBOR and Smile\n   + (cbor) \u0027ArrayIndexOutOfBounds\u0027 for truncated UTF-8 name\n   + (avro) Generate logicalType switch\n   + (smile) \u0027ArrayIndexOutOfBounds\u0027 for truncated UTF-8 name\n   + (ion) \u0027jackson-dataformat-ion\u0027 does not handle\n      null.struct deserialization correctly\n   + \u0027Ion-java\u0027 dep 1.4.0 -\u003e 1.8.0\n   + Minor change to Ion module registration names (fully-qualified)\n   + (cbor) Uncaught exception in CBORParser._nextChunkedByte2 (by ossfuzzer)\n   + (cbor) Uncaught exception in CBORParser._findDecodedFromSymbols() (by ossfuzzer)\n   + (smile) Uncaught validation problem wrt Smile \u0027BigDecimal\u0027 type\n   + (smile) ArrayIndexOutOfBoundsException for malformed Smile header\n   + (cbor) Failed to handle case of alleged String with length of Integer.MAX_VALUE\n   + (smile) Allocate byte[] lazily for longer Smile binary data payloads\n   + (cbor) CBORParser need to validate zero-length byte[] for BigInteger\n   + (smile) Handle invalid chunked-binary-format length gracefully\n   + (smile) Allocate byte[] lazily for longer Smile binary data payloads (7-bit encoded)\n   + (smile)  ArrayIndexOutOfBoundsException in SmileParser._decodeShortUnicodeValue()\n   + (smile) Handle sequence of Smile header markers without recursion\n   + (cbor) CBOR loses \u0027Map\u0027 entries with specific \u0027long\u0027 Map key values (32-bit boundary)\n   + (ion) Ion Polymorphic deserialization in 2.12 breaks wrt use of Native Type Ids \n     when upgrading from 2.8\n   + (cbor) \u0027ArrayIndexOutOfBoundsException\u0027 in \u0027CBORParser\u0027 for invalid UTF-8 String\n   + (cbor) Handle invalid CBOR content like \u0027[0x84]\u0027 (incomplete array)\n   + (ion) Respect \u0027WRITE_ENUMS_USING_TO_STRING\u0027 in \u0027EnumAsIonSymbolSerializer\u0027\n   + (ion) Add support for generating IonSexps\n   + (ion) Add support for deserializing IonTimestamps and IonBlobs\n   + (ion) Add \u0027IonObjectMapper.builderForBinaryWriters()\u0027 /\n      \u0027.builderforTextualWriters()\u0027 convenience methods\n   + (ion) Enabling pretty-printing fails Ion serialization\n   + (ion) Allow disabling native type ids in IonMapper\n   + (smile) Small bug in byte-alignment for long field names\n      in Smile, symbol table reuse\n   + (ion) Add \u0027IonFactory.getIonSystem()\u0027 accessor\n   + (ion) Optimize \u0027IonParser.getNumberType()\u0027 using\n      \u0027IonReader.getIntegerSize()\u0027\n   + (cbor) Add \u0027CBORGenerator.Feature.LENIENT_UTF_ENCODING\u0027\n      for lenient handling of Unicode surrogate pairs on writing\n   + (cbor) Add support for decoding unassigned \u0027simple\n      values\u0027 (type 7)\n   + Add Gradle Module Metadata\n      (https://blog.gradle.org/alignment-with-gradle-module-metadata)\n   + (avro) Cache record names to avoid hitting class loader\n   + (avro) Avro null deserialization\n   + (ion) Add \u0027IonFactory.getIonSystem()\u0027 accessor\n   + (avro) Add \u0027AvroGenerator.canWriteBinaryNatively()\u0027 to\n      support binary writes, fix \u0027java.util.UUID\u0027 representation\n   + (ion) Allow \u0027IonObjectMapper\u0027 with class name annotation\n      introspector to deserialize generic subtypes\n   + Remove dependencies upon Jackson 1.X and Avro\u0027s\n      JacksonUtils\n   + \u0027jackson-databind\u0027 should not be full dependency for\n      (cbor, protobuf, smile) modules\n   + \u0027CBORGenerator.Feature.WRITE_MINIMAL_INTS\u0027 does not\n      write most compact form for all integers\n   + \u0027AvroGenerator\u0027 overrides \u0027getOutputContext()\u0027 properly\n   + (ion) Add \u0027IonFactory.getIonSystem()\u0027 accessor\n   + (avro) Fix schema evolution involving maps of non-scalar\n   + (protobuf) Parsing a protobuf message doesn\u0027t properly skip unknown fields\n   + (ion) IonObjectMapper close()s the provided IonWriter unnecessarily\n   + ion-java dependency 1.4.0 -\u003e 1.5.1  \n  ",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2022-1678,SUSE-SLE-Module-Basesystem-15-SP3-2022-1678,SUSE-SLE-Module-Basesystem-15-SP4-2022-1678,SUSE-SLE-Module-Development-Tools-15-SP3-2022-1678,SUSE-SLE-Module-Development-Tools-15-SP4-2022-1678,SUSE-SLE-Module-SUSE-Manager-Server-4.3-2022-1678,SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-1678,SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-1678,SUSE-SLE-Product-RT-15-SP2-2022-1678,SUSE-SLE-Product-SLES-15-SP2-BCL-2022-1678,SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-1678,SUSE-SLE-Product-SLES_SAP-15-SP2-2022-1678,SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-1678,SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-1678,SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-1678,SUSE-Storage-7-2022-1678,openSUSE-SLE-15.3-2022-1678,openSUSE-SLE-15.4-2022-1678",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_1678-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2022:1678-1",
        "url": "https://www.suse.com/support/update/announcement/2022/suse-su-20221678-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2022:1678-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-May/011022.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177616",
        "url": "https://bugzilla.suse.com/1177616"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1182481",
        "url": "https://bugzilla.suse.com/1182481"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1197132",
        "url": "https://bugzilla.suse.com/1197132"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-25649 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-25649/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-28491 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-28491/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-36518 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-36518/"
      }
    ],
    "title": "Security update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core",
    "tracking": {
      "current_release_date": "2022-05-16T08:19:25Z",
      "generator": {
        "date": "2022-05-16T08:19:25Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2022:1678-1",
      "initial_release_date": "2022-05-16T08:19:25Z",
      "revision_history": [
        {
          "date": "2022-05-16T08:19:25Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jackson-annotations-2.13.0-150200.3.6.1.noarch",
                "product": {
                  "name": "jackson-annotations-2.13.0-150200.3.6.1.noarch",
                  "product_id": "jackson-annotations-2.13.0-150200.3.6.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
                "product": {
                  "name": "jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
                  "product_id": "jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jackson-bom-2.13.0-150200.3.3.1.noarch",
                "product": {
                  "name": "jackson-bom-2.13.0-150200.3.3.1.noarch",
                  "product_id": "jackson-bom-2.13.0-150200.3.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jackson-core-2.13.0-150200.3.6.1.noarch",
                "product": {
                  "name": "jackson-core-2.13.0-150200.3.6.1.noarch",
                  "product_id": "jackson-core-2.13.0-150200.3.6.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
                "product": {
                  "name": "jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
                  "product_id": "jackson-core-javadoc-2.13.0-150200.3.6.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jackson-databind-2.13.0-150200.3.9.1.noarch",
                "product": {
                  "name": "jackson-databind-2.13.0-150200.3.9.1.noarch",
                  "product_id": "jackson-databind-2.13.0-150200.3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
                "product": {
                  "name": "jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
                  "product_id": "jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
                "product": {
                  "name": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
                  "product_id": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch",
                "product": {
                  "name": "jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch",
                  "product_id": "jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch",
                "product": {
                  "name": "jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch",
                  "product_id": "jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch",
                "product": {
                  "name": "jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch",
                  "product_id": "jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Basesystem 15 SP3",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Basesystem 15 SP3",
                  "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-basesystem:15:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Basesystem 15 SP4",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Basesystem 15 SP4",
                  "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-basesystem:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Development Tools 15 SP3",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Development Tools 15 SP3",
                  "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-development-tools:15:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Development Tools 15 SP4",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Development Tools 15 SP4",
                  "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-development-tools:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-espos:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Real Time 15 SP2",
                "product": {
                  "name": "SUSE Linux Enterprise Real Time 15 SP2",
                  "product_id": "SUSE Linux Enterprise Real Time 15 SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_rt:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP2-BCL",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP2-BCL",
                  "product_id": "SUSE Linux Enterprise Server 15 SP2-BCL",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_bcl:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP2-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP2-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Manager Proxy 4.1",
                "product": {
                  "name": "SUSE Manager Proxy 4.1",
                  "product_id": "SUSE Manager Proxy 4.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-manager-proxy:4.1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Manager Retail Branch Server 4.1",
                "product": {
                  "name": "SUSE Manager Retail Branch Server 4.1",
                  "product_id": "SUSE Manager Retail Branch Server 4.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-manager-retail-branch-server:4.1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Manager Server 4.1",
                "product": {
                  "name": "SUSE Manager Server 4.1",
                  "product_id": "SUSE Manager Server 4.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-manager-server:4.1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Enterprise Storage 7",
                "product": {
                  "name": "SUSE Enterprise Storage 7",
                  "product_id": "SUSE Enterprise Storage 7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:ses:7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.3",
                "product": {
                  "name": "openSUSE Leap 15.3",
                  "product_id": "openSUSE Leap 15.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.4",
                "product": {
                  "name": "openSUSE Leap 15.4",
                  "product_id": "openSUSE Leap 15.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-annotations-2.13.0-150200.3.6.1.noarch as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-annotations-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-annotations-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-core-2.13.0-150200.3.6.1.noarch as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-core-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-core-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-core-javadoc-2.13.0-150200.3.6.1.noarch as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-databind-2.13.0-150200.3.9.1.noarch as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-databind-2.13.0-150200.3.9.1.noarch"
        },
        "product_reference": "jackson-databind-2.13.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch"
        },
        "product_reference": "jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-annotations-2.13.0-150200.3.6.1.noarch as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-annotations-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-annotations-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-core-2.13.0-150200.3.6.1.noarch as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-core-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-core-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-databind-2.13.0-150200.3.9.1.noarch as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-databind-2.13.0-150200.3.9.1.noarch"
        },
        "product_reference": "jackson-databind-2.13.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-annotations-2.13.0-150200.3.6.1.noarch as component of SUSE Linux Enterprise Module for Development Tools 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-annotations-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-annotations-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-core-2.13.0-150200.3.6.1.noarch as component of SUSE Linux Enterprise Module for Development Tools 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-core-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-core-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-databind-2.13.0-150200.3.9.1.noarch as component of SUSE Linux Enterprise Module for Development Tools 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-databind-2.13.0-150200.3.9.1.noarch"
        },
        "product_reference": "jackson-databind-2.13.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch as component of SUSE Linux Enterprise Module for Development Tools 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch"
        },
        "product_reference": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch as component of SUSE Linux Enterprise Module for Development Tools 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP4:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch"
        },
        "product_reference": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-annotations-2.13.0-150200.3.6.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-annotations-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-annotations-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-core-2.13.0-150200.3.6.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-core-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-core-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-databind-2.13.0-150200.3.9.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-databind-2.13.0-150200.3.9.1.noarch"
        },
        "product_reference": "jackson-databind-2.13.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch"
        },
        "product_reference": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-annotations-2.13.0-150200.3.6.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-annotations-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-annotations-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-core-2.13.0-150200.3.6.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-core-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-core-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-databind-2.13.0-150200.3.9.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-databind-2.13.0-150200.3.9.1.noarch"
        },
        "product_reference": "jackson-databind-2.13.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch"
        },
        "product_reference": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-annotations-2.13.0-150200.3.6.1.noarch as component of SUSE Linux Enterprise Real Time 15 SP2",
          "product_id": "SUSE Linux Enterprise Real Time 15 SP2:jackson-annotations-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-annotations-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Real Time 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-core-2.13.0-150200.3.6.1.noarch as component of SUSE Linux Enterprise Real Time 15 SP2",
          "product_id": "SUSE Linux Enterprise Real Time 15 SP2:jackson-core-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-core-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Real Time 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-databind-2.13.0-150200.3.9.1.noarch as component of SUSE Linux Enterprise Real Time 15 SP2",
          "product_id": "SUSE Linux Enterprise Real Time 15 SP2:jackson-databind-2.13.0-150200.3.9.1.noarch"
        },
        "product_reference": "jackson-databind-2.13.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Real Time 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch as component of SUSE Linux Enterprise Real Time 15 SP2",
          "product_id": "SUSE Linux Enterprise Real Time 15 SP2:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch"
        },
        "product_reference": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Real Time 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-annotations-2.13.0-150200.3.6.1.noarch as component of SUSE Linux Enterprise Server 15 SP2-BCL",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-annotations-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-annotations-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-BCL"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-core-2.13.0-150200.3.6.1.noarch as component of SUSE Linux Enterprise Server 15 SP2-BCL",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-core-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-core-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-BCL"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-databind-2.13.0-150200.3.9.1.noarch as component of SUSE Linux Enterprise Server 15 SP2-BCL",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-databind-2.13.0-150200.3.9.1.noarch"
        },
        "product_reference": "jackson-databind-2.13.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-BCL"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch as component of SUSE Linux Enterprise Server 15 SP2-BCL",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch"
        },
        "product_reference": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-BCL"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-annotations-2.13.0-150200.3.6.1.noarch as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-annotations-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-annotations-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-core-2.13.0-150200.3.6.1.noarch as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-core-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-core-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-databind-2.13.0-150200.3.9.1.noarch as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-databind-2.13.0-150200.3.9.1.noarch"
        },
        "product_reference": "jackson-databind-2.13.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch"
        },
        "product_reference": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-annotations-2.13.0-150200.3.6.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-annotations-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-annotations-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-core-2.13.0-150200.3.6.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-core-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-core-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-databind-2.13.0-150200.3.9.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-databind-2.13.0-150200.3.9.1.noarch"
        },
        "product_reference": "jackson-databind-2.13.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch"
        },
        "product_reference": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-annotations-2.13.0-150200.3.6.1.noarch as component of SUSE Manager Proxy 4.1",
          "product_id": "SUSE Manager Proxy 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-annotations-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Manager Proxy 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-core-2.13.0-150200.3.6.1.noarch as component of SUSE Manager Proxy 4.1",
          "product_id": "SUSE Manager Proxy 4.1:jackson-core-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-core-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Manager Proxy 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-databind-2.13.0-150200.3.9.1.noarch as component of SUSE Manager Proxy 4.1",
          "product_id": "SUSE Manager Proxy 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch"
        },
        "product_reference": "jackson-databind-2.13.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Manager Proxy 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch as component of SUSE Manager Proxy 4.1",
          "product_id": "SUSE Manager Proxy 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch"
        },
        "product_reference": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
        "relates_to_product_reference": "SUSE Manager Proxy 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-annotations-2.13.0-150200.3.6.1.noarch as component of SUSE Manager Retail Branch Server 4.1",
          "product_id": "SUSE Manager Retail Branch Server 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-annotations-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Manager Retail Branch Server 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-core-2.13.0-150200.3.6.1.noarch as component of SUSE Manager Retail Branch Server 4.1",
          "product_id": "SUSE Manager Retail Branch Server 4.1:jackson-core-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-core-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Manager Retail Branch Server 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-databind-2.13.0-150200.3.9.1.noarch as component of SUSE Manager Retail Branch Server 4.1",
          "product_id": "SUSE Manager Retail Branch Server 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch"
        },
        "product_reference": "jackson-databind-2.13.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Manager Retail Branch Server 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch as component of SUSE Manager Retail Branch Server 4.1",
          "product_id": "SUSE Manager Retail Branch Server 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch"
        },
        "product_reference": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
        "relates_to_product_reference": "SUSE Manager Retail Branch Server 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-annotations-2.13.0-150200.3.6.1.noarch as component of SUSE Manager Server 4.1",
          "product_id": "SUSE Manager Server 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-annotations-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Manager Server 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-core-2.13.0-150200.3.6.1.noarch as component of SUSE Manager Server 4.1",
          "product_id": "SUSE Manager Server 4.1:jackson-core-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-core-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Manager Server 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-databind-2.13.0-150200.3.9.1.noarch as component of SUSE Manager Server 4.1",
          "product_id": "SUSE Manager Server 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch"
        },
        "product_reference": "jackson-databind-2.13.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Manager Server 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch as component of SUSE Manager Server 4.1",
          "product_id": "SUSE Manager Server 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch"
        },
        "product_reference": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
        "relates_to_product_reference": "SUSE Manager Server 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-annotations-2.13.0-150200.3.6.1.noarch as component of SUSE Enterprise Storage 7",
          "product_id": "SUSE Enterprise Storage 7:jackson-annotations-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-annotations-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Enterprise Storage 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-core-2.13.0-150200.3.6.1.noarch as component of SUSE Enterprise Storage 7",
          "product_id": "SUSE Enterprise Storage 7:jackson-core-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-core-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "SUSE Enterprise Storage 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-databind-2.13.0-150200.3.9.1.noarch as component of SUSE Enterprise Storage 7",
          "product_id": "SUSE Enterprise Storage 7:jackson-databind-2.13.0-150200.3.9.1.noarch"
        },
        "product_reference": "jackson-databind-2.13.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Enterprise Storage 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch as component of SUSE Enterprise Storage 7",
          "product_id": "SUSE Enterprise Storage 7:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch"
        },
        "product_reference": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
        "relates_to_product_reference": "SUSE Enterprise Storage 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-annotations-2.13.0-150200.3.6.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jackson-annotations-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-annotations-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-bom-2.13.0-150200.3.3.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jackson-bom-2.13.0-150200.3.3.1.noarch"
        },
        "product_reference": "jackson-bom-2.13.0-150200.3.3.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-core-2.13.0-150200.3.6.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jackson-core-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-core-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-core-javadoc-2.13.0-150200.3.6.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-databind-2.13.0-150200.3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jackson-databind-2.13.0-150200.3.9.1.noarch"
        },
        "product_reference": "jackson-databind-2.13.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch"
        },
        "product_reference": "jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch"
        },
        "product_reference": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch"
        },
        "product_reference": "jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch"
        },
        "product_reference": "jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch"
        },
        "product_reference": "jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-annotations-2.13.0-150200.3.6.1.noarch as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:jackson-annotations-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-annotations-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-bom-2.13.0-150200.3.3.1.noarch as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:jackson-bom-2.13.0-150200.3.3.1.noarch"
        },
        "product_reference": "jackson-bom-2.13.0-150200.3.3.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-core-2.13.0-150200.3.6.1.noarch as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:jackson-core-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-core-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-core-javadoc-2.13.0-150200.3.6.1.noarch as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch"
        },
        "product_reference": "jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-databind-2.13.0-150200.3.9.1.noarch as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:jackson-databind-2.13.0-150200.3.9.1.noarch"
        },
        "product_reference": "jackson-databind-2.13.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch"
        },
        "product_reference": "jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch"
        },
        "product_reference": "jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch"
        },
        "product_reference": "jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch"
        },
        "product_reference": "jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch"
        },
        "product_reference": "jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-25649",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-25649"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Enterprise Storage 7:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Enterprise Storage 7:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Enterprise Storage 7:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Enterprise Storage 7:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Linux Enterprise Module for Development Tools 15 SP4:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Linux Enterprise Real Time 15 SP2:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Real Time 15 SP2:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Real Time 15 SP2:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Real Time 15 SP2:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Manager Proxy 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Manager Proxy 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Manager Proxy 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Manager Proxy 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Manager Retail Branch Server 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Manager Retail Branch Server 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Manager Retail Branch Server 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Manager Retail Branch Server 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Manager Server 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Manager Server 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Manager Server 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Manager Server 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "openSUSE Leap 15.3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "openSUSE Leap 15.3:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
          "openSUSE Leap 15.3:jackson-bom-2.13.0-150200.3.3.1.noarch",
          "openSUSE Leap 15.3:jackson-core-2.13.0-150200.3.6.1.noarch",
          "openSUSE Leap 15.3:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
          "openSUSE Leap 15.3:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "openSUSE Leap 15.3:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
          "openSUSE Leap 15.3:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "openSUSE Leap 15.3:jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch",
          "openSUSE Leap 15.3:jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch",
          "openSUSE Leap 15.3:jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch",
          "openSUSE Leap 15.4:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "openSUSE Leap 15.4:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
          "openSUSE Leap 15.4:jackson-bom-2.13.0-150200.3.3.1.noarch",
          "openSUSE Leap 15.4:jackson-core-2.13.0-150200.3.6.1.noarch",
          "openSUSE Leap 15.4:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
          "openSUSE Leap 15.4:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "openSUSE Leap 15.4:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
          "openSUSE Leap 15.4:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "openSUSE Leap 15.4:jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch",
          "openSUSE Leap 15.4:jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch",
          "openSUSE Leap 15.4:jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-25649",
          "url": "https://www.suse.com/security/cve/CVE-2020-25649"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1177616 for CVE-2020-25649",
          "url": "https://bugzilla.suse.com/1177616"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Enterprise Storage 7:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Enterprise Storage 7:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Enterprise Storage 7:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Enterprise Storage 7:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Real Time 15 SP2:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Real Time 15 SP2:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Real Time 15 SP2:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Real Time 15 SP2:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Manager Proxy 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Proxy 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Proxy 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Manager Proxy 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Manager Retail Branch Server 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Retail Branch Server 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Retail Branch Server 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Manager Retail Branch Server 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Manager Server 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Server 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Server 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Manager Server 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.3:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.3:jackson-bom-2.13.0-150200.3.3.1.noarch",
            "openSUSE Leap 15.3:jackson-core-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.3:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.3:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.3:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.3:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.3:jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.3:jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.3:jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.4:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.4:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.4:jackson-bom-2.13.0-150200.3.3.1.noarch",
            "openSUSE Leap 15.4:jackson-core-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.4:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.4:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.4:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.4:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.4:jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.4:jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.4:jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Enterprise Storage 7:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Enterprise Storage 7:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Enterprise Storage 7:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Enterprise Storage 7:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Real Time 15 SP2:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Real Time 15 SP2:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Real Time 15 SP2:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Real Time 15 SP2:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Manager Proxy 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Proxy 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Proxy 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Manager Proxy 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Manager Retail Branch Server 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Retail Branch Server 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Retail Branch Server 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Manager Retail Branch Server 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Manager Server 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Server 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Server 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Manager Server 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.3:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.3:jackson-bom-2.13.0-150200.3.3.1.noarch",
            "openSUSE Leap 15.3:jackson-core-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.3:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.3:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.3:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.3:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.3:jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.3:jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.3:jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.4:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.4:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.4:jackson-bom-2.13.0-150200.3.3.1.noarch",
            "openSUSE Leap 15.4:jackson-core-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.4:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.4:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.4:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.4:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.4:jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.4:jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.4:jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-05-16T08:19:25Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-25649"
    },
    {
      "cve": "CVE-2020-28491",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-28491"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Enterprise Storage 7:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Enterprise Storage 7:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Enterprise Storage 7:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Enterprise Storage 7:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Linux Enterprise Module for Development Tools 15 SP4:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Linux Enterprise Real Time 15 SP2:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Real Time 15 SP2:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Real Time 15 SP2:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Real Time 15 SP2:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Manager Proxy 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Manager Proxy 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Manager Proxy 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Manager Proxy 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Manager Retail Branch Server 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Manager Retail Branch Server 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Manager Retail Branch Server 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Manager Retail Branch Server 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Manager Server 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Manager Server 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Manager Server 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Manager Server 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "openSUSE Leap 15.3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "openSUSE Leap 15.3:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
          "openSUSE Leap 15.3:jackson-bom-2.13.0-150200.3.3.1.noarch",
          "openSUSE Leap 15.3:jackson-core-2.13.0-150200.3.6.1.noarch",
          "openSUSE Leap 15.3:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
          "openSUSE Leap 15.3:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "openSUSE Leap 15.3:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
          "openSUSE Leap 15.3:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "openSUSE Leap 15.3:jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch",
          "openSUSE Leap 15.3:jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch",
          "openSUSE Leap 15.3:jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch",
          "openSUSE Leap 15.4:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "openSUSE Leap 15.4:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
          "openSUSE Leap 15.4:jackson-bom-2.13.0-150200.3.3.1.noarch",
          "openSUSE Leap 15.4:jackson-core-2.13.0-150200.3.6.1.noarch",
          "openSUSE Leap 15.4:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
          "openSUSE Leap 15.4:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "openSUSE Leap 15.4:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
          "openSUSE Leap 15.4:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "openSUSE Leap 15.4:jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch",
          "openSUSE Leap 15.4:jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch",
          "openSUSE Leap 15.4:jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-28491",
          "url": "https://www.suse.com/security/cve/CVE-2020-28491"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1182481 for CVE-2020-28491",
          "url": "https://bugzilla.suse.com/1182481"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Enterprise Storage 7:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Enterprise Storage 7:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Enterprise Storage 7:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Enterprise Storage 7:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Real Time 15 SP2:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Real Time 15 SP2:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Real Time 15 SP2:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Real Time 15 SP2:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Manager Proxy 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Proxy 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Proxy 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Manager Proxy 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Manager Retail Branch Server 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Retail Branch Server 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Retail Branch Server 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Manager Retail Branch Server 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Manager Server 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Server 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Server 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Manager Server 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.3:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.3:jackson-bom-2.13.0-150200.3.3.1.noarch",
            "openSUSE Leap 15.3:jackson-core-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.3:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.3:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.3:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.3:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.3:jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.3:jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.3:jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.4:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.4:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.4:jackson-bom-2.13.0-150200.3.3.1.noarch",
            "openSUSE Leap 15.4:jackson-core-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.4:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.4:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.4:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.4:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.4:jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.4:jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.4:jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Enterprise Storage 7:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Enterprise Storage 7:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Enterprise Storage 7:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Enterprise Storage 7:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Real Time 15 SP2:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Real Time 15 SP2:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Real Time 15 SP2:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Real Time 15 SP2:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Manager Proxy 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Proxy 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Proxy 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Manager Proxy 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Manager Retail Branch Server 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Retail Branch Server 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Retail Branch Server 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Manager Retail Branch Server 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Manager Server 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Server 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Server 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Manager Server 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.3:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.3:jackson-bom-2.13.0-150200.3.3.1.noarch",
            "openSUSE Leap 15.3:jackson-core-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.3:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.3:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.3:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.3:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.3:jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.3:jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.3:jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.4:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.4:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.4:jackson-bom-2.13.0-150200.3.3.1.noarch",
            "openSUSE Leap 15.4:jackson-core-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.4:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.4:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.4:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.4:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.4:jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.4:jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.4:jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-05-16T08:19:25Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-28491"
    },
    {
      "cve": "CVE-2020-36518",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-36518"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Enterprise Storage 7:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Enterprise Storage 7:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Enterprise Storage 7:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Enterprise Storage 7:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Linux Enterprise Module for Development Tools 15 SP4:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Linux Enterprise Real Time 15 SP2:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Real Time 15 SP2:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Real Time 15 SP2:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Real Time 15 SP2:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Manager Proxy 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Manager Proxy 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Manager Proxy 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Manager Proxy 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Manager Retail Branch Server 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Manager Retail Branch Server 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Manager Retail Branch Server 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Manager Retail Branch Server 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "SUSE Manager Server 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "SUSE Manager Server 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
          "SUSE Manager Server 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "SUSE Manager Server 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "openSUSE Leap 15.3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "openSUSE Leap 15.3:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
          "openSUSE Leap 15.3:jackson-bom-2.13.0-150200.3.3.1.noarch",
          "openSUSE Leap 15.3:jackson-core-2.13.0-150200.3.6.1.noarch",
          "openSUSE Leap 15.3:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
          "openSUSE Leap 15.3:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "openSUSE Leap 15.3:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
          "openSUSE Leap 15.3:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "openSUSE Leap 15.3:jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch",
          "openSUSE Leap 15.3:jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch",
          "openSUSE Leap 15.3:jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch",
          "openSUSE Leap 15.4:jackson-annotations-2.13.0-150200.3.6.1.noarch",
          "openSUSE Leap 15.4:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
          "openSUSE Leap 15.4:jackson-bom-2.13.0-150200.3.3.1.noarch",
          "openSUSE Leap 15.4:jackson-core-2.13.0-150200.3.6.1.noarch",
          "openSUSE Leap 15.4:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
          "openSUSE Leap 15.4:jackson-databind-2.13.0-150200.3.9.1.noarch",
          "openSUSE Leap 15.4:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
          "openSUSE Leap 15.4:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
          "openSUSE Leap 15.4:jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch",
          "openSUSE Leap 15.4:jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch",
          "openSUSE Leap 15.4:jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-36518",
          "url": "https://www.suse.com/security/cve/CVE-2020-36518"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1197132 for CVE-2020-36518",
          "url": "https://bugzilla.suse.com/1197132"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Enterprise Storage 7:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Enterprise Storage 7:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Enterprise Storage 7:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Enterprise Storage 7:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Real Time 15 SP2:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Real Time 15 SP2:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Real Time 15 SP2:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Real Time 15 SP2:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Manager Proxy 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Proxy 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Proxy 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Manager Proxy 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Manager Retail Branch Server 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Retail Branch Server 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Retail Branch Server 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Manager Retail Branch Server 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Manager Server 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Server 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Server 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Manager Server 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.3:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.3:jackson-bom-2.13.0-150200.3.3.1.noarch",
            "openSUSE Leap 15.3:jackson-core-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.3:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.3:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.3:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.3:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.3:jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.3:jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.3:jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.4:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.4:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.4:jackson-bom-2.13.0-150200.3.3.1.noarch",
            "openSUSE Leap 15.4:jackson-core-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.4:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.4:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.4:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.4:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.4:jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.4:jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.4:jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Enterprise Storage 7:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Enterprise Storage 7:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Enterprise Storage 7:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Enterprise Storage 7:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Module for Development Tools 15 SP4:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Real Time 15 SP2:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Real Time 15 SP2:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Real Time 15 SP2:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Real Time 15 SP2:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-BCL:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Manager Proxy 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Proxy 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Proxy 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Manager Proxy 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Manager Retail Branch Server 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Retail Branch Server 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Retail Branch Server 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Manager Retail Branch Server 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "SUSE Manager Server 4.1:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Server 4.1:jackson-core-2.13.0-150200.3.6.1.noarch",
            "SUSE Manager Server 4.1:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "SUSE Manager Server 4.1:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.3:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.3:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.3:jackson-bom-2.13.0-150200.3.3.1.noarch",
            "openSUSE Leap 15.3:jackson-core-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.3:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.3:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.3:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.3:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.3:jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.3:jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.3:jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.4:jackson-annotations-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.4:jackson-annotations-javadoc-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.4:jackson-bom-2.13.0-150200.3.3.1.noarch",
            "openSUSE Leap 15.4:jackson-core-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.4:jackson-core-javadoc-2.13.0-150200.3.6.1.noarch",
            "openSUSE Leap 15.4:jackson-databind-2.13.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.4:jackson-databind-javadoc-2.13.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.4:jackson-dataformat-cbor-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.4:jackson-dataformat-smile-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.4:jackson-dataformats-binary-2.13.0-150200.3.3.3.noarch",
            "openSUSE Leap 15.4:jackson-dataformats-binary-javadoc-2.13.0-150200.3.3.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-05-16T08:19:25Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-36518"
    }
  ]
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202012-1529",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "utilities framework",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "4.3.0.6.0"
      },
      {
        "model": "banking platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "2.7.0"
      },
      {
        "model": "communications messaging server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.0.2"
      },
      {
        "model": "banking apis",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "18.1"
      },
      {
        "model": "banking platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "2.9.0"
      },
      {
        "model": "utilities framework",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "4.4.0.3.0"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "32"
      },
      {
        "model": "communications pricing design center",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.0.0.4.0"
      },
      {
        "model": "oncommand workflow automation",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "banking platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "2.7.1"
      },
      {
        "model": "commerce platform",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.3.2"
      },
      {
        "model": "jackson-databind",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "fasterxml",
        "version": "2.9.0"
      },
      {
        "model": "retail service backbone",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1.3.2"
      },
      {
        "model": "communications instant messaging server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.0.1.5.0"
      },
      {
        "model": "banking treasury management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "4.4"
      },
      {
        "model": "utilities framework",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "4.4.0.2.0"
      },
      {
        "model": "agile product lifecycle management integration pack",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "3.6"
      },
      {
        "model": "banking platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "2.10.0"
      },
      {
        "model": "retail xstore point of service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "19.0.2"
      },
      {
        "model": "primavera gateway",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "18.8.0"
      },
      {
        "model": "banking apis",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "20.1"
      },
      {
        "model": "jackson-databind",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "fasterxml",
        "version": "2.10.0"
      },
      {
        "model": "communications unified inventory management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.4.1"
      },
      {
        "model": "communications convergent charging controller",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.0.4.0.0"
      },
      {
        "model": "primavera gateway",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "19.12.0"
      },
      {
        "model": "utilities framework",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "4.3.0.5.0"
      },
      {
        "model": "banking apis",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "18.3"
      },
      {
        "model": "webcenter portal",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.3.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.3.0"
      },
      {
        "model": "banking platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "2.6.2"
      },
      {
        "model": "jd edwards enterpriseone orchestrator",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "9.2.5.3"
      },
      {
        "model": "iotdb",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "apache",
        "version": "0.12.0"
      },
      {
        "model": "communications interactive session recorder",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "6.3"
      },
      {
        "model": "health sciences empirica signal",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "9.0"
      },
      {
        "model": "goldengate application adapters",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "19.1.0.0.0"
      },
      {
        "model": "coherence",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1.1.0.0"
      },
      {
        "model": "communications interactive session recorder",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "6.4"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.0.2"
      },
      {
        "model": "insurance rules palette",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.1.0"
      },
      {
        "model": "jd edwards enterpriseone tools",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "9.2.5.3"
      },
      {
        "model": "primavera gateway",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "17.7"
      },
      {
        "model": "jackson-databind",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fasterxml",
        "version": "2.6.7.4"
      },
      {
        "model": "utilities framework",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "4.4.0.0.0"
      },
      {
        "model": "blockchain platform",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "21.1.2"
      },
      {
        "model": "communications messaging server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.1"
      },
      {
        "model": "coherence",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.4.0"
      },
      {
        "model": "sd-wan edge",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "9.0"
      },
      {
        "model": "communications services gatekeeper",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.0"
      },
      {
        "model": "primavera gateway",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "19.12.10"
      },
      {
        "model": "health sciences empirica signal",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "9.1"
      },
      {
        "model": "oncommand api services",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "primavera gateway",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "17.12.0"
      },
      {
        "model": "insurance policy administration",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.0.2"
      },
      {
        "model": "insurance policy administration",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.1.0"
      },
      {
        "model": "retail xstore point of service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "20.0.1"
      },
      {
        "model": "banking apis",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "19.2"
      },
      {
        "model": "primavera gateway",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "20.12.0"
      },
      {
        "model": "communications offline mediation controller",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.0.0.3"
      },
      {
        "model": "retail service backbone",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0.3.1"
      },
      {
        "model": "communications network charging and control",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.0.4.0.0"
      },
      {
        "model": "webcenter portal",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.4.0"
      },
      {
        "model": "primavera gateway",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "18.8.11"
      },
      {
        "model": "communications evolved communications application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.1"
      },
      {
        "model": "communications cloud native core unified data repository",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "1.4.0"
      },
      {
        "model": "banking apis",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "21.1"
      },
      {
        "model": "jackson-databind",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "fasterxml",
        "version": "2.6.0"
      },
      {
        "model": "agile plm",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "9.3.6"
      },
      {
        "model": "commerce platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.2.0"
      },
      {
        "model": "retail xstore point of service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "17.0.4"
      },
      {
        "model": "banking apis",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "19.1"
      },
      {
        "model": "service level manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "quarkus",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "quarkus",
        "version": "1.6.1"
      },
      {
        "model": "jackson-databind",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fasterxml",
        "version": "2.10.5.1"
      },
      {
        "model": "commerce platform",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.3.0"
      },
      {
        "model": "communications billing and revenue management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.5.0.23.0"
      },
      {
        "model": "primavera gateway",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "17.12"
      },
      {
        "model": "jackson-databind",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fasterxml",
        "version": "2.9.10.7"
      },
      {
        "model": "communications billing and revenue management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.0.0.3.0"
      },
      {
        "model": "retail xstore point of service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "18.0.3"
      },
      {
        "model": "insurance policy administration",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.3.0"
      },
      {
        "model": "banking platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "2.8.0"
      },
      {
        "model": "primavera gateway",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "17.12.11"
      },
      {
        "model": "retail service backbone",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.3"
      },
      {
        "model": "retail xstore point of service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.6"
      },
      {
        "model": "hitachi ops center analyzer viewpoint",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u65e5\u7acb",
        "version": null
      },
      {
        "model": "service level manager",
        "scope": null,
        "trust": 0.8,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "oncommand workflow automation",
        "scope": null,
        "trust": 0.8,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "fedora",
        "scope": null,
        "trust": 0.8,
        "vendor": "fedora",
        "version": null
      },
      {
        "model": "oncommand api services",
        "scope": null,
        "trust": 0.8,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "quarkus",
        "scope": null,
        "trust": 0.8,
        "vendor": "quarkus",
        "version": null
      },
      {
        "model": "jackson-databind",
        "scope": null,
        "trust": 0.8,
        "vendor": "fasterxml",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-014030"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-25649"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.10.5.1",
                "versionStartIncluding": "2.10.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.9.10.7",
                "versionStartIncluding": "2.9.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.6.7.4",
                "versionStartIncluding": "2.6.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.6.1",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.12.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:utilities_framework:4.3.0.5.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:goldengate_application_adapters:19.1.0.0.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_service_backbone:16.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:banking_platform:2.8.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "17.12",
                "versionStartIncluding": "17.7",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:insurance_rules_palette:11.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:communications_interactive_session_recorder:6.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:oracle:communications_messaging_server:8.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:commerce_platform:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "11.3.2",
                "versionStartIncluding": "11.3.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:commerce_platform:11.2.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:health_sciences_empirica_signal:9.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:banking_platform:2.10.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_service_backbone:15.0.3.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "9.2.5.3",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "9.2.5.3",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:insurance_rules_palette:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "11.3.0",
                "versionStartIncluding": "11.1.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "11.3.0",
                "versionStartIncluding": "11.1.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:insurance_policy_administration:11.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:banking_treasury_management:4.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:primavera_gateway:20.12.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "19.12.10",
                "versionStartIncluding": "19.12.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "18.8.11",
                "versionStartIncluding": "18.8.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "17.12.11",
                "versionStartIncluding": "17.12.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.4.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:communications_network_charging_and_control:12.0.4.0.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:communications_convergent_charging_controller:12.0.4.0.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:health_sciences_empirica_signal:9.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:agile_product_lifecycle_management_integration_pack:3.6:*:*:*:*:e-business_suite:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.4.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "18.3",
                "versionStartIncluding": "18.1",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "21.1.2",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-25649"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Red Hat",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "162696"
      },
      {
        "db": "PACKETSTORM",
        "id": "163201"
      },
      {
        "db": "PACKETSTORM",
        "id": "160346"
      },
      {
        "db": "PACKETSTORM",
        "id": "159973"
      },
      {
        "db": "PACKETSTORM",
        "id": "162478"
      },
      {
        "db": "PACKETSTORM",
        "id": "160349"
      },
      {
        "db": "PACKETSTORM",
        "id": "159767"
      }
    ],
    "trust": 0.7
  },
  "cve": "CVE-2020-25649",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 5.0,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2020-25649",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.9,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "VHN-179648",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "impactScore": 3.6,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 7.5,
            "baseSeverity": "High",
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2020-25649",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2020-25649",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-179648",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2020-25649",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-179648"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-25649"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-014030"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-25649"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity. FasterXML Jackson is a data processing tool for Java developed by American FasterXML Company. There is a security vulnerability in FasterXML Jackson Databind, which can be exploited by an attacker to transmit malicious XML data to FasterXML Jackson Databind to read files, scan sites, or trigger a denial of service. The purpose of this text-only\nerrata is to inform you about the security issues fixed in this release. Description:\n\nRed Hat Process Automation Manager is an open source business process\nmanagement suite that combines process management and decision service\nmanagement and enables business and IT users to create, manage, validate,\nand deploy process applications and decision services. \n\nSecurity Fix(es):\n\n* xmlgraphics-commons: SSRF due to improper input validation by the\nXMPParser (CVE-2020-11988)\n\n* xstream: allow a remote attacker to cause DoS only by manipulating the\nprocessed input stream (CVE-2021-21341)\n\n* xstream: allow a remote attacker to load and execute arbitrary code from\na remote host only by manipulating the processed input stream\n(CVE-2021-21351)\n\n* xstream: arbitrary file deletion on the local host via crafted input\nstream (CVE-2021-21343)\n\n* xstream: arbitrary file deletion on the local host when unmarshalling\n(CVE-2020-26259)\n\n* xstream: ReDoS vulnerability (CVE-2021-21348)\n\n* xstream: Server-Side Forgery Request vulnerability can be activated when\nunmarshalling (CVE-2020-26258)\n\n* xstream: SSRF can be activated unmarshalling with XStream to access data\nstreams from an arbitrary URL referencing a resource in an intranet or the\nlocal host (CVE-2021-21349)\n\n* xstream: SSRF via crafted input stream (CVE-2021-21342)\n\n* jackson-databind: FasterXML DOMDeserializer insecure entity expansion is\nvulnerable to XML external entity (XXE) (CVE-2020-25649)\n\n* xstream: allow a remote attacker to execute arbitrary code only by\nmanipulating the processed input stream (CVE-2021-21350)\n\n* xstream: allow a remote attacker to load and execute arbitrary code from\na remote host only by manipulating the processed input stream\n(CVE-2021-21347)\n\n* xstream: allow a remote attacker to load and execute arbitrary code from\na remote host only by manipulating the processed input stream\n(CVE-2021-21346)\n\n* xstream: allow a remote attacker who has sufficient rights to execute\ncommands of the host only by manipulating the processed input stream\n(CVE-2021-21345)\n\n* xstream: arbitrary code execution via crafted input stream\n(CVE-2021-21344)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. Bugs fixed (https://bugzilla.redhat.com/):\n\n1887664 - CVE-2020-25649 jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)\n1908832 - CVE-2020-26258 XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling\n1908837 - CVE-2020-26259 XStream: arbitrary file deletion on the local host when unmarshalling\n1933816 - CVE-2020-11988 xmlgraphics-commons: SSRF due to improper input validation by the XMPParser\n1942539 - CVE-2021-21341 XStream: allow a remote attacker to cause DoS only by manipulating the processed input stream\n1942545 - CVE-2021-21342 XStream: SSRF via crafted input stream\n1942550 - CVE-2021-21343 XStream: arbitrary file deletion on the local host via crafted input stream\n1942554 - CVE-2021-21344 XStream: Unsafe deserizaliation of javax.sql.rowset.BaseRowSet\n1942558 - CVE-2021-21345 XStream: Unsafe deserizaliation of com.sun.corba.se.impl.activation.ServerTableEntry\n1942578 - CVE-2021-21346 XStream: Unsafe deserizaliation of sun.swing.SwingLazyValue\n1942629 - CVE-2021-21347 XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator\n1942633 - CVE-2021-21348 XStream: ReDoS vulnerability\n1942635 - CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host\n1942637 - CVE-2021-21350 XStream: Unsafe deserizaliation of com.sun.org.apache.bcel.internal.util.ClassLoader\n1942642 - CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream\n\n5. \n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). See the following advisory for the container images for\nthis release:\n\nhttps://access.redhat.com/errata/RHBA-2021:1427\n\nAll OpenShift Container Platform 4.6 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift Console\nor the CLI oc command. Instructions for upgrading a cluster are available\nat\n\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster\n- -between-minor.html#understanding-upgrade-channels_updating-cluster-between\n- -minor\n\n3. Solution:\n\nFor OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-rel\nease-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster\n- -cli.html\n\n4. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n====================================================================                   \nRed Hat Security Advisory\n\nSynopsis:          Important: Red Hat JBoss Enterprise Application Platform 7.3.4 security update\nAdvisory ID:       RHSA-2020:5342-01\nProduct:           Red Hat JBoss Enterprise Application Platform\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2020:5342\nIssue date:        2020-12-03\nCVE Names:         CVE-2020-25638 CVE-2020-25644 CVE-2020-25649\n====================================================================\n1. Summary:\n\nAn update is now available for Red Hat JBoss Enterprise Application\nPlatform 7.3 for Red Hat Enterprise Linux 8. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat JBoss EAP 7.3 for BaseOS-8 - noarch\n\n3. Description:\n\nRed Hat JBoss Enterprise Application Platform 7 is a platform for Java\napplications based on the WildFly application runtime. \n\nThis release of Red Hat JBoss Enterprise Application Platform 7.3.4 serves\nas a replacement for Red Hat JBoss Enterprise Application Platform 7.3.3,\nand includes bug fixes and enhancements. See the Red Hat JBoss Enterprise\nApplication Platform 7.3.4 Release Notes for information about the most\nsignificant bug fixes and enhancements included in this release. \n\nSecurity Fix(es):\n\n* jackson-databind: FasterXML DOMDeserializer insecure entity expansion is\nvulnerable to XML external entity (CVE-2020-25649)\n\n* hibernate-core: SQL injection vulnerability when both\nhibernate.use_sql_comments and JPQL String literals are used\n(CVE-2020-25638)\n\n* wildfly-openssl: memory leak per HTTP session creation in WildFly OpenSSL\n(CVE-2020-25644)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, and other related information, see the CVE page(s) listed in the\nReferences section. \n\n4. Solution:\n\nBefore applying this update, ensure all previously released errata relevant\nto your system have been applied. \n\nFor details about how to apply this update, see:\n\nhttps://access.redhat.com/articles/11258\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1881353 - CVE-2020-25638 hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used\n1885485 - CVE-2020-25644 wildfly-openssl: memory leak per HTTP session creation in WildFly OpenSSL\n1887664 - CVE-2020-25649 jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)\n\n6. JIRA issues fixed (https://issues.jboss.org/):\n\nJBEAP-20029 - [GSS](7.3.z) Upgrade Artemis from 2.9.0.redhat-00011 to 2.9.0.redhat-00016\nJBEAP-20089 - [GSS] (7.3.z) Upgrade undertow from 2.0.31.SP1-redhat-00001 to 2.0.32.SP1-redhat\nJBEAP-20119 - [GSS](7.3.z) Upgrade JBoss Remoting from 5.0.18.Final-redhat-00001 to 5.0.19.Final-redhat-00001\nJBEAP-20161 - [GSS](7.3.z) Upgrade XNIO from 3.7.9.Final to 3.7.11.Final\nJBEAP-20223 - Tracker bug for the EAP 7.3.4 release for RHEL-8\nJBEAP-20239 - [GSS](7.3.z) Upgrade Hibernate Validator from 6.0.20.Final to 6.0.21.Final\nJBEAP-20246 - [GSS](7.3.z) Upgrade JBoss Marshalling from 2.0.9.Final to 2.0.10.Final\nJBEAP-20285 - [GSS](7.3.z) Upgrade HAL from 3.2.10.Final-redhat-00001 to 3.2.11.Final\nJBEAP-20300 - (7.3.z) Upgrade jasypt from 1.9.3-redhat-00001 to 1.9.3-redhat-00002\nJBEAP-20325 - (7.3.z) Upgrade WildFly Arquillian to 3.0.1.Final for the ts.bootable profile\nJBEAP-20364 - (7.3.z) Upgrade com.github.fge.msg-simple to 1.1.0.redhat-00007 and com.github.fge.btf to 1.2.0.redhat-00007\nJBEAP-20368 - (7.3.z) Upgrade Bootable JAR Maven plugin to 2.0.1.Final\n\n7. Package List:\n\nRed Hat JBoss EAP 7.3 for BaseOS-8:\n\nSource:\neap7-activemq-artemis-2.9.0-6.redhat_00016.1.el8eap.src.rpm\neap7-fge-btf-1.2.0-1.redhat_00007.1.el8eap.src.rpm\neap7-fge-msg-simple-1.1.0-1.redhat_00007.1.el8eap.src.rpm\neap7-hal-console-3.2.11-1.Final_redhat_00001.1.el8eap.src.rpm\neap7-hibernate-validator-6.0.21-1.Final_redhat_00001.1.el8eap.src.rpm\neap7-jackson-annotations-2.10.4-1.redhat_00002.1.el8eap.src.rpm\neap7-jackson-core-2.10.4-1.redhat_00002.1.el8eap.src.rpm\neap7-jackson-coreutils-1.6.0-1.redhat_00006.1.el8eap.src.rpm\neap7-jackson-jaxrs-providers-2.10.4-1.redhat_00002.1.el8eap.src.rpm\neap7-jackson-modules-base-2.10.4-3.redhat_00002.1.el8eap.src.rpm\neap7-jackson-modules-java8-2.10.4-1.redhat_00002.1.el8eap.src.rpm\neap7-jasypt-1.9.3-1.redhat_00002.1.el8eap.src.rpm\neap7-jboss-marshalling-2.0.10-1.Final_redhat_00001.1.el8eap.src.rpm\neap7-jboss-remoting-5.0.19-1.Final_redhat_00001.1.el8eap.src.rpm\neap7-jboss-server-migration-1.7.2-3.Final_redhat_00004.1.el8eap.src.rpm\neap7-jboss-xnio-base-3.7.11-1.Final_redhat_00001.1.el8eap.src.rpm\neap7-undertow-2.0.32-1.SP1_redhat_00001.1.el8eap.src.rpm\neap7-wildfly-7.3.4-3.GA_redhat_00003.1.el8eap.src.rpm\neap7-wildfly-elytron-1.10.9-1.Final_redhat_00001.1.el8eap.src.rpm\neap7-wildfly-openssl-1.0.12-1.Final_redhat_00001.1.el8eap.src.rpm\n\nnoarch:\neap7-activemq-artemis-2.9.0-6.redhat_00016.1.el8eap.noarch.rpm\neap7-activemq-artemis-cli-2.9.0-6.redhat_00016.1.el8eap.noarch.rpm\neap7-activemq-artemis-commons-2.9.0-6.redhat_00016.1.el8eap.noarch.rpm\neap7-activemq-artemis-core-client-2.9.0-6.redhat_00016.1.el8eap.noarch.rpm\neap7-activemq-artemis-dto-2.9.0-6.redhat_00016.1.el8eap.noarch.rpm\neap7-activemq-artemis-hornetq-protocol-2.9.0-6.redhat_00016.1.el8eap.noarch.rpm\neap7-activemq-artemis-hqclient-protocol-2.9.0-6.redhat_00016.1.el8eap.noarch.rpm\neap7-activemq-artemis-jdbc-store-2.9.0-6.redhat_00016.1.el8eap.noarch.rpm\neap7-activemq-artemis-jms-client-2.9.0-6.redhat_00016.1.el8eap.noarch.rpm\neap7-activemq-artemis-jms-server-2.9.0-6.redhat_00016.1.el8eap.noarch.rpm\neap7-activemq-artemis-journal-2.9.0-6.redhat_00016.1.el8eap.noarch.rpm\neap7-activemq-artemis-ra-2.9.0-6.redhat_00016.1.el8eap.noarch.rpm\neap7-activemq-artemis-selector-2.9.0-6.redhat_00016.1.el8eap.noarch.rpm\neap7-activemq-artemis-server-2.9.0-6.redhat_00016.1.el8eap.noarch.rpm\neap7-activemq-artemis-service-extensions-2.9.0-6.redhat_00016.1.el8eap.noarch.rpm\neap7-activemq-artemis-tools-2.9.0-6.redhat_00016.1.el8eap.noarch.rpm\neap7-fge-btf-1.2.0-1.redhat_00007.1.el8eap.noarch.rpm\neap7-fge-msg-simple-1.1.0-1.redhat_00007.1.el8eap.noarch.rpm\neap7-hal-console-3.2.11-1.Final_redhat_00001.1.el8eap.noarch.rpm\neap7-hibernate-validator-6.0.21-1.Final_redhat_00001.1.el8eap.noarch.rpm\neap7-hibernate-validator-cdi-6.0.21-1.Final_redhat_00001.1.el8eap.noarch.rpm\neap7-jackson-annotations-2.10.4-1.redhat_00002.1.el8eap.noarch.rpm\neap7-jackson-core-2.10.4-1.redhat_00002.1.el8eap.noarch.rpm\neap7-jackson-coreutils-1.6.0-1.redhat_00006.1.el8eap.noarch.rpm\neap7-jackson-datatype-jdk8-2.10.4-1.redhat_00002.1.el8eap.noarch.rpm\neap7-jackson-datatype-jsr310-2.10.4-1.redhat_00002.1.el8eap.noarch.rpm\neap7-jackson-jaxrs-base-2.10.4-1.redhat_00002.1.el8eap.noarch.rpm\neap7-jackson-jaxrs-json-provider-2.10.4-1.redhat_00002.1.el8eap.noarch.rpm\neap7-jackson-module-jaxb-annotations-2.10.4-3.redhat_00002.1.el8eap.noarch.rpm\neap7-jackson-modules-base-2.10.4-3.redhat_00002.1.el8eap.noarch.rpm\neap7-jackson-modules-java8-2.10.4-1.redhat_00002.1.el8eap.noarch.rpm\neap7-jasypt-1.9.3-1.redhat_00002.1.el8eap.noarch.rpm\neap7-jboss-marshalling-2.0.10-1.Final_redhat_00001.1.el8eap.noarch.rpm\neap7-jboss-marshalling-river-2.0.10-1.Final_redhat_00001.1.el8eap.noarch.rpm\neap7-jboss-remoting-5.0.19-1.Final_redhat_00001.1.el8eap.noarch.rpm\neap7-jboss-server-migration-1.7.2-3.Final_redhat_00004.1.el8eap.noarch.rpm\neap7-jboss-server-migration-cli-1.7.2-3.Final_redhat_00004.1.el8eap.noarch.rpm\neap7-jboss-server-migration-core-1.7.2-3.Final_redhat_00004.1.el8eap.noarch.rpm\neap7-jboss-server-migration-eap6.4-1.7.2-3.Final_redhat_00004.1.el8eap.noarch.rpm\neap7-jboss-server-migration-eap6.4-to-eap7.3-1.7.2-3.Final_redhat_00004.1.el8eap.noarch.rpm\neap7-jboss-server-migration-eap7.0-1.7.2-3.Final_redhat_00004.1.el8eap.noarch.rpm\neap7-jboss-server-migration-eap7.1-1.7.2-3.Final_redhat_00004.1.el8eap.noarch.rpm\neap7-jboss-server-migration-eap7.2-1.7.2-3.Final_redhat_00004.1.el8eap.noarch.rpm\neap7-jboss-server-migration-eap7.2-to-eap7.3-1.7.2-3.Final_redhat_00004.1.el8eap.noarch.rpm\neap7-jboss-server-migration-eap7.3-server-1.7.2-3.Final_redhat_00004.1.el8eap.noarch.rpm\neap7-jboss-server-migration-wildfly10.0-1.7.2-3.Final_redhat_00004.1.el8eap.noarch.rpm\neap7-jboss-server-migration-wildfly10.1-1.7.2-3.Final_redhat_00004.1.el8eap.noarch.rpm\neap7-jboss-server-migration-wildfly11.0-1.7.2-3.Final_redhat_00004.1.el8eap.noarch.rpm\neap7-jboss-server-migration-wildfly12.0-1.7.2-3.Final_redhat_00004.1.el8eap.noarch.rpm\neap7-jboss-server-migration-wildfly13.0-server-1.7.2-3.Final_redhat_00004.1.el8eap.noarch.rpm\neap7-jboss-server-migration-wildfly14.0-server-1.7.2-3.Final_redhat_00004.1.el8eap.noarch.rpm\neap7-jboss-server-migration-wildfly15.0-server-1.7.2-3.Final_redhat_00004.1.el8eap.noarch.rpm\neap7-jboss-server-migration-wildfly16.0-server-1.7.2-3.Final_redhat_00004.1.el8eap.noarch.rpm\neap7-jboss-server-migration-wildfly17.0-server-1.7.2-3.Final_redhat_00004.1.el8eap.noarch.rpm\neap7-jboss-server-migration-wildfly18.0-server-1.7.2-3.Final_redhat_00004.1.el8eap.noarch.rpm\neap7-jboss-server-migration-wildfly8.2-1.7.2-3.Final_redhat_00004.1.el8eap.noarch.rpm\neap7-jboss-server-migration-wildfly9.0-1.7.2-3.Final_redhat_00004.1.el8eap.noarch.rpm\neap7-jboss-xnio-base-3.7.11-1.Final_redhat_00001.1.el8eap.noarch.rpm\neap7-undertow-2.0.32-1.SP1_redhat_00001.1.el8eap.noarch.rpm\neap7-wildfly-7.3.4-3.GA_redhat_00003.1.el8eap.noarch.rpm\neap7-wildfly-elytron-1.10.9-1.Final_redhat_00001.1.el8eap.noarch.rpm\neap7-wildfly-elytron-tool-1.10.9-1.Final_redhat_00001.1.el8eap.noarch.rpm\neap7-wildfly-javadocs-7.3.4-3.GA_redhat_00003.1.el8eap.noarch.rpm\neap7-wildfly-modules-7.3.4-3.GA_redhat_00003.1.el8eap.noarch.rpm\neap7-wildfly-openssl-1.0.12-1.Final_redhat_00001.1.el8eap.noarch.rpm\neap7-wildfly-openssl-java-1.0.12-1.Final_redhat_00001.1.el8eap.noarch.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n8. References:\n\nhttps://access.redhat.com/security/cve/CVE-2020-25638\nhttps://access.redhat.com/security/cve/CVE-2020-25644\nhttps://access.redhat.com/security/cve/CVE-2020-25649\nhttps://access.redhat.com/security/updates/classification/#important\nhttps://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/\nhttps://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/\n\n9. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2020 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBX8k7Y9zjgjWX9erEAQgaMA/8D6uRPrTX/XmXtkeZw9Y9yMoLHIYpl083\niv71vIyCkmQXHFmsYidw0jI6euRhHmihMY5DMyci3zAHqa7KbX1pqQsXWPIvWVnv\nykpkGtPGUoqlJU7FDZq00Vk+/bykOEIcAmBJJCoNuLAS09gub2l2UPD3QGC1cZfa\n7ziYlGTufSOYN6RInoSGiOgqUpYQzF35oZT2Vwc5b92ZGx6rj08vrCGNmF9SXRYc\n+yy1IIVGMdYe/1IEcpq936F8AKxJYiqyhsLP4orkt1GxC5P8RGnGvUoIwZmrDq06\nxBPP44WmbAmFu8t3hcBUBs+ewzAc9swmy7ZKu8yuJfmxcDlyz/pVpPg8tLfCZRbg\nXRekSfvEzRw6lidGv5vMqUUoRxJd5LicaWSW93jus01UahLVMTGyPMAVHcdeP1P7\nn29R5ZNWk5e9cWCmTL10T3+6Rf4brnbUf09mCsgSwSsuejCoxdD0JLaC0z953cqC\nga5z8xSYtXmQdhOKZIhQ17el2Prdw82Vw11dNFvN3AsQMu3exSOp+MAhh9bs5/Ba\nHcvSdryXIkEy/3atBUZxoDZu6ZJRHB0yWuk3CsvoW3lJuBGhVS1Wah+9g8Lq0H5y\nQkpRwaCU+SxNXG+VAq59ZP8jKyl87mMzRQ4w0touglb/YqSZfp2dpAqC5t8zPfeO\nB8NkNn8eYYs=+qXq\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. \n\nYou must restart the JBoss server process for the update to take effect",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-25649"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-014030"
      },
      {
        "db": "VULHUB",
        "id": "VHN-179648"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-25649"
      },
      {
        "db": "PACKETSTORM",
        "id": "162696"
      },
      {
        "db": "PACKETSTORM",
        "id": "163201"
      },
      {
        "db": "PACKETSTORM",
        "id": "160346"
      },
      {
        "db": "PACKETSTORM",
        "id": "159973"
      },
      {
        "db": "PACKETSTORM",
        "id": "162478"
      },
      {
        "db": "PACKETSTORM",
        "id": "160349"
      },
      {
        "db": "PACKETSTORM",
        "id": "159767"
      }
    ],
    "trust": 2.43
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2020-25649",
        "trust": 2.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-014030",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "160349",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "160346",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "162478",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "159973",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "162696",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "163201",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "159767",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "163205",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "160347",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "160489",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "160348",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "160554",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "159759",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "159680",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "161261",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "162240",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "161766",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "160535",
        "trust": 0.1
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202010-622",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-179648",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-25649",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-179648"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-25649"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-014030"
      },
      {
        "db": "PACKETSTORM",
        "id": "162696"
      },
      {
        "db": "PACKETSTORM",
        "id": "163201"
      },
      {
        "db": "PACKETSTORM",
        "id": "160346"
      },
      {
        "db": "PACKETSTORM",
        "id": "159973"
      },
      {
        "db": "PACKETSTORM",
        "id": "162478"
      },
      {
        "db": "PACKETSTORM",
        "id": "160349"
      },
      {
        "db": "PACKETSTORM",
        "id": "159767"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-25649"
      }
    ]
  },
  "id": "VAR-202012-1529",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-179648"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-07-23T21:57:50.923000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "hitachi-sec-2021-111",
        "trust": 0.8,
        "url": "https://github.com/fasterxml/jackson-databind/issues/2589"
      },
      {
        "title": "Red Hat: Important: Red Hat JBoss Enterprise Application Platform 7.3 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20204401 - security advisory"
      },
      {
        "title": "Red Hat: Important: Red Hat Data Grid 7.3.8 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20205410 - security advisory"
      },
      {
        "title": "Red Hat: Important: Red Hat JBoss Enterprise Application Platform 7.3 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20204402 - security advisory"
      },
      {
        "title": "Red Hat: Important: Red Hat build of Eclipse Vert.x 3.9.4 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20204379 - security advisory"
      },
      {
        "title": "Red Hat: Important: rh-maven35-jackson-databind security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20204312 - security advisory"
      },
      {
        "title": "Red Hat: Low: RHV-M(ovirt-engine) 4.4.z security, bug fix, enhancement update [ovirt-4.4.4]",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20210381 - security advisory"
      },
      {
        "title": "Red Hat: Important: Red Hat JBoss Enterprise Application Platform 7.3.4 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20205341 - security advisory"
      },
      {
        "title": "Red Hat: Important: Red Hat JBoss Enterprise Application Platform 7.3.4 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20205340 - security advisory"
      },
      {
        "title": "Red Hat: Important: Red Hat JBoss Enterprise Application Platform 7.3.4 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20205342 - security advisory"
      },
      {
        "title": "Red Hat: Important: Red Hat JBoss Enterprise Application Platform 7.3.4 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20205344 - security advisory"
      },
      {
        "title": "Red Hat: Important: Red Hat Single Sign-On 7.4.4 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20205533 - security advisory"
      },
      {
        "title": "Red Hat: Important: Red Hat build of Thorntail 2.7.2 security and bug fix update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20205361 - security advisory"
      },
      {
        "title": "IBM: Security Bulletin: IBM Network Performance Insight 1.3.1 was affected by vulnerability in jackson-databind (CVE-2020-25649)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=5d8938176e857437de15675453ad2b9a"
      },
      {
        "title": "IBM: Security Bulletin: A vulnerability have been identified in FasterXML Jackson Databind shipped with IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library (CVE-2020-25649)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=e73bd45b3af488f816a21700b2fd0ee8"
      },
      {
        "title": "IBM: Security Bulletin: IBM CloudPak foundational services (Events Operator) is affected by potential data integrity issue (CVE-2020-25649)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=83af1574b941aa6afccbfb11a9d6dd60"
      },
      {
        "title": "IBM: Security Bulletin: Vulnerabilities in FasterXML Jackson Databind and Apache Xerces affect IBM Spectrum Protect Backup-Archive Client, IBM Spectrum Protect for Space Management, and IBM Spectrum Protect for Virtual Environments",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=0169ebe66d0191409c7149d7151593fb"
      },
      {
        "title": "Hitachi Security Advisories: Multiple Vulnerabilities in Hitachi Ops Center Analyzer viewpoint",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=hitachi_security_advisories\u0026qid=hitachi-sec-2021-111"
      },
      {
        "title": "IBM: Security Bulletin:  IBM Security Guardium is affected by a jackson-databind vulnerability",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=d264422afa3e01b012ccac75b242e1cb"
      },
      {
        "title": "IBM: Security Bulletin: z/Transaction Processing Facility is affected by multiple vulnerabilities in the jackson-databind, jackson-dataformat-xml, jackson-core, slf4j-ext, and cxf-core packages",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=f974282a27702bae4111bf7716ee6cf6"
      },
      {
        "title": "IBM: Security Bulletin: Multiple vulnerabilities in Data-Binding for Jackson shipped with IBM Operations Analytics \u00e2\u20ac\u201c Log Analysis",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=1db4c8cb14383c63d0c04205c943ef8a"
      },
      {
        "title": "sbom-utility",
        "trust": 0.1,
        "url": "https://github.com/cyclonedx/sbom-utility "
      },
      {
        "title": "Apache JMeter",
        "trust": 0.1,
        "url": "https://github.com/mosaic-hgw/jmeter "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/pctf/vulnerable-app "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2020-25649"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-014030"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-611",
        "trust": 1.1
      },
      {
        "problemtype": "XML Improper restrictions on external entity references (CWE-611) [ Other ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-179648"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-014030"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-25649"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-25649"
      },
      {
        "trust": 1.1,
        "url": "https://security.netapp.com/advisory/ntap-20210108-0007/"
      },
      {
        "trust": 1.1,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1887664"
      },
      {
        "trust": 1.1,
        "url": "https://github.com/fasterxml/jackson-databind/issues/2589"
      },
      {
        "trust": 1.1,
        "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
      },
      {
        "trust": 1.1,
        "url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
      },
      {
        "trust": 1.1,
        "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
      },
      {
        "trust": 1.1,
        "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
      },
      {
        "trust": 1.1,
        "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
      },
      {
        "trust": 1.1,
        "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r011d1430e8f40dff9550c3bc5d0f48b14c01ba8aecabd91d5e495386%40%3ccommits.turbine.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r024b7bda9c43c5560d81238748775c5ecfe01b57280f90df1f773949%40%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r04529cedaca40c2ff90af4880493f9c88a8ebf4d1d6c861d23108a5a%40%3cnotifications.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r0881e23bd9034c8f51fdccdc8f4d085ba985dcd738f8520569ca5c3d%40%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r0b8dc3acd4503e4ecb6fbd6ea7d95f59941168d8452ac0ab1d1d96bb%40%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r1b7ed0c4b6c4301d4dfd6fdbc5581b0a789d3240cab55d766f33c6c6%40%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r2882fc1f3032cd7be66e28787f04ec6f1874ac68d47e310e30ff7eb1%40%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r2b6ddb3a4f4cd11d8f6305011e1b7438ba813511f2e3ab3180c7ffda%40%3ccommits.druid.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r2eb66c182853c69ecfb52f63d3dec09495e9b65be829fd889a081ae1%40%3cdev.hive.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r2f5c5479f99398ef344b7ebd4d90bc3316236c45d0f3bc42090efcd7%40%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r31f4ee7d561d56a0c2c2c6eb1d6ce3e05917ff9654fdbfec05dc2b83%40%3ccommits.servicecomb.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r3e6ae311842de4e64c5d560a475b7f9cc7e0a9a8649363c6cf7537eb%40%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r407538adec3185dd35a05c9a26ae2f74425b15132470cf540f41d85b%40%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r45e7350dfc92bb192f3f88e9971c11ab2be0953cc375be3dda5170bd%40%3cissues.flink.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r5b130fe668503c4b7e2caf1b16f86b7f2070fd1b7ef8f26195a2ffbd%40%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r5f8a1608d758936bd6bbc5eed980777437b611537bf6fff40663fc71%40%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r605764e05e201db33b3e9c2e66ff620658f07ad74f296abe483f7042%40%3creviews.iotdb.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3cdev.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3cusers.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r63c87aab97155f3f3cbe11d030c4a184ea0de440ee714977db02e956%40%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r68d029ee74ab0f3b0569d0c05f5688cb45dd3abe96a6534735252805%40%3cnotifications.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r6a4f3ef6edfed2e0884269d84798f766779bbbc1005f7884e0800d61%40%3cdev.knox.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r6a6df5647583541e3cb71c75141008802f7025cee1c430d4ed78f4cc%40%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r6b11eca1d646f45eb0d35d174e6b1e47cfae5295b92000856bfb6304%40%3cdev.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r6b11eca1d646f45eb0d35d174e6b1e47cfae5295b92000856bfb6304%40%3cusers.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r6cbd599b80e787f02ff7a1391d9278a03f37d6a6f4f943f0f01a62fb%40%3creviews.iotdb.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r6e3d4f7991542119a4ca6330271d7fbf7b9fb3abab24ada82ddf1ee4%40%3cnotifications.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r73bef1bb601a9f093f915f8075eb49fcca51efade57b817afd5def07%40%3ccommits.iotdb.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r765283e145049df9b8998f14dcd444345555aae02b1610cfb3188bf8%40%3cnotifications.iotdb.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r78d53a0a269c18394daf5940105dc8c7f9a2399503c2e78be20abe7e%40%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r7cb5b4b3e4bd41a8042e5725b7285877a17bcbf07f4eb3f7b316af60%40%3creviews.iotdb.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r86c78bf7656fdb2dab69cbf17f3d7492300f771025f1a3a65d5e5ce5%40%3ccommits.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r8764bb835bcb8e311c882ff91dd3949c9824e905e880930be56f6ba3%40%3cuser.spark.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r8937a7160717fe8b2221767163c4de4f65bc5466405cb1c5310f9080%40%3cdev.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r8937a7160717fe8b2221767163c4de4f65bc5466405cb1c5310f9080%40%3cusers.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r8ae961c80930e2717c75025414ce48a432cea1137c02f648b1fb9524%40%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r900d4408c4189b376d1ec580ea7740ea6f8710dc2f0b7e9c9eeb5ae0%40%3cdev.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r90d1e97b0a743cf697d89a792a9b669909cc5a1692d1e0083a22e66c%40%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r91722ecfba688b0c565675f8bf380269fde8ec62b54d6161db544c22%40%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r94c7e86e546120f157264ba5ba61fd29b3a8d530ed325a9b4fa334d7%40%3ccommits.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r95a297eb5fd1f2d3a2281f15340e2413f952e9d5503296c3adc7201a%40%3ccommits.tomee.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r98bfe3b90ea9408f12c4b447edcb5638703d80bc782430aa0c210a54%40%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/ra1157e57a01d25e36b0dc17959ace758fc21ba36746de29ba1d8b130%40%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/ra409f798a1e5a6652b7097429b388650ccd65fd958cee0b6f69bba00%40%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/ra95faf968f3463acb3f31a6fbec31453fc5045325f99f396961886d3%40%3cissues.flink.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/raf13235de6df1d47a717199e1ecd700dff3236632f5c9a1488d9845b%40%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rb674520b9f6c808c1bf263b1369e14048ec3243615f35cfd24e33604%40%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3cdev.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3cusers.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rc15e90bbef196a5c6c01659e015249d6c9a73581ca9afb8aeecf00d2%40%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rc82ff47853289e9cd17f5cfbb053c04cafc75ee32e3d7223963f83bb%40%3cdev.knox.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rc88f2fa2b7bd6443921727aeee7704a1fb02433e722e2abf677e0d3d%40%3ccommits.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rc959cdb57c4fe198316130ff4a5ecbf9d680e356032ff2e9f4f05d54%40%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rd317f15a675d114dbf5b488d27eeb2467b4424356b16116eb18a652d%40%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rd57c7582adc90e233f23f3727db3df9115b27a823b92374f11453f34%40%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rd6f6bf848c2d47fa4a85c27d011d948778b8f7e58ba495968435a0b3%40%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rdca8711bb7aa5d47a44682606cd0ea3497e2e922f22b7ee83e81e6c1%40%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rdf9a34726482222c90d50ae1b9847881de67dde8cfde4999633d2cdc%40%3ccommits.zookeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/re16f81d3ad49a93dd2f0cba9f8fc88e5fb89f30bf9a2ad7b6f3e69c1%40%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/re96dc7a13e13e56190a5d80f9e5440a0d0c83aeec6467b562fbf2dca%40%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rf1809a1374041a969d77afab21fc38925de066bc97e86157d3ac3402%40%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6x2ut4x6m7dlqyboohmxbwgyj65rl2ct/"
      },
      {
        "trust": 0.9,
        "url": "https://lists.apache.org/thread.html/r8937a7160717fe8b2221767163c4de4f65bc5466405cb1c5310f9080@%3cdev.kafka.apache.org%3e"
      },
      {
        "trust": 0.9,
        "url": "https://lists.apache.org/thread.html/r8937a7160717fe8b2221767163c4de4f65bc5466405cb1c5310f9080@%3cusers.kafka.apache.org%3e"
      },
      {
        "trust": 0.9,
        "url": "https://lists.apache.org/thread.html/rdf9a34726482222c90d50ae1b9847881de67dde8cfde4999633d2cdc@%3ccommits.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.9,
        "url": "https://lists.apache.org/thread.html/rc88f2fa2b7bd6443921727aeee7704a1fb02433e722e2abf677e0d3d@%3ccommits.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.9,
        "url": "https://lists.apache.org/thread.html/r94c7e86e546120f157264ba5ba61fd29b3a8d530ed325a9b4fa334d7@%3ccommits.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.9,
        "url": "https://lists.apache.org/thread.html/r86c78bf7656fdb2dab69cbf17f3d7492300f771025f1a3a65d5e5ce5@%3ccommits.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.7,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.7,
        "url": "https://access.redhat.com/security/cve/cve-2020-25649"
      },
      {
        "trust": 0.4,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-25638"
      },
      {
        "trust": 0.3,
        "url": "https://listman.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2020-25638"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "trust": 0.2,
        "url": "https://issues.jboss.org/):"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-25644"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2020-25644"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/team/key/"
      },
      {
        "trust": 0.1,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6x2ut4x6m7dlqyboohmxbwgyj65rl2ct/"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r31f4ee7d561d56a0c2c2c6eb1d6ce3e05917ff9654fdbfec05dc2b83@%3ccommits.servicecomb.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r2b6ddb3a4f4cd11d8f6305011e1b7438ba813511f2e3ab3180c7ffda@%3ccommits.druid.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/ra95faf968f3463acb3f31a6fbec31453fc5045325f99f396961886d3@%3cissues.flink.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r45e7350dfc92bb192f3f88e9971c11ab2be0953cc375be3dda5170bd@%3cissues.flink.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r2eb66c182853c69ecfb52f63d3dec09495e9b65be829fd889a081ae1@%3cdev.hive.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r0881e23bd9034c8f51fdccdc8f4d085ba985dcd738f8520569ca5c3d@%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r5b130fe668503c4b7e2caf1b16f86b7f2070fd1b7ef8f26195a2ffbd@%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rd57c7582adc90e233f23f3727db3df9115b27a823b92374f11453f34@%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r407538adec3185dd35a05c9a26ae2f74425b15132470cf540f41d85b@%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r2f5c5479f99398ef344b7ebd4d90bc3316236c45d0f3bc42090efcd7@%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/ra409f798a1e5a6652b7097429b388650ccd65fd958cee0b6f69bba00@%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rdca8711bb7aa5d47a44682606cd0ea3497e2e922f22b7ee83e81e6c1@%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r8ae961c80930e2717c75025414ce48a432cea1137c02f648b1fb9524@%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r6a6df5647583541e3cb71c75141008802f7025cee1c430d4ed78f4cc@%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r024b7bda9c43c5560d81238748775c5ecfe01b57280f90df1f773949@%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r73bef1bb601a9f093f915f8075eb49fcca51efade57b817afd5def07@%3ccommits.iotdb.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r765283e145049df9b8998f14dcd444345555aae02b1610cfb3188bf8@%3cnotifications.iotdb.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r7cb5b4b3e4bd41a8042e5725b7285877a17bcbf07f4eb3f7b316af60@%3creviews.iotdb.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r605764e05e201db33b3e9c2e66ff620658f07ad74f296abe483f7042@%3creviews.iotdb.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r6cbd599b80e787f02ff7a1391d9278a03f37d6a6f4f943f0f01a62fb@%3creviews.iotdb.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r6b11eca1d646f45eb0d35d174e6b1e47cfae5295b92000856bfb6304@%3cdev.kafka.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3cdev.kafka.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3cdev.kafka.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/ra1157e57a01d25e36b0dc17959ace758fc21ba36746de29ba1d8b130@%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r2882fc1f3032cd7be66e28787f04ec6f1874ac68d47e310e30ff7eb1@%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/re96dc7a13e13e56190a5d80f9e5440a0d0c83aeec6467b562fbf2dca@%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rd317f15a675d114dbf5b488d27eeb2467b4424356b16116eb18a652d@%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r1b7ed0c4b6c4301d4dfd6fdbc5581b0a789d3240cab55d766f33c6c6@%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rc959cdb57c4fe198316130ff4a5ecbf9d680e356032ff2e9f4f05d54@%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r63c87aab97155f3f3cbe11d030c4a184ea0de440ee714977db02e956@%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rc15e90bbef196a5c6c01659e015249d6c9a73581ca9afb8aeecf00d2@%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/raf13235de6df1d47a717199e1ecd700dff3236632f5c9a1488d9845b@%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r78d53a0a269c18394daf5940105dc8c7f9a2399503c2e78be20abe7e@%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r5f8a1608d758936bd6bbc5eed980777437b611537bf6fff40663fc71@%3cjira.kafka.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r6b11eca1d646f45eb0d35d174e6b1e47cfae5295b92000856bfb6304@%3cusers.kafka.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3cusers.kafka.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3cusers.kafka.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rf1809a1374041a969d77afab21fc38925de066bc97e86157d3ac3402@%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r3e6ae311842de4e64c5d560a475b7f9cc7e0a9a8649363c6cf7537eb@%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/re16f81d3ad49a93dd2f0cba9f8fc88e5fb89f30bf9a2ad7b6f3e69c1@%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r91722ecfba688b0c565675f8bf380269fde8ec62b54d6161db544c22@%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rc82ff47853289e9cd17f5cfbb053c04cafc75ee32e3d7223963f83bb@%3cdev.knox.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r6a4f3ef6edfed2e0884269d84798f766779bbbc1005f7884e0800d61@%3cdev.knox.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r8764bb835bcb8e311c882ff91dd3949c9824e905e880930be56f6ba3@%3cuser.spark.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r95a297eb5fd1f2d3a2281f15340e2413f952e9d5503296c3adc7201a@%3ccommits.tomee.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r011d1430e8f40dff9550c3bc5d0f48b14c01ba8aecabd91d5e495386@%3ccommits.turbine.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r900d4408c4189b376d1ec580ea7740ea6f8710dc2f0b7e9c9eeb5ae0@%3cdev.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r98bfe3b90ea9408f12c4b447edcb5638703d80bc782430aa0c210a54@%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r90d1e97b0a743cf697d89a792a9b669909cc5a1692d1e0083a22e66c@%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r0b8dc3acd4503e4ecb6fbd6ea7d95f59941168d8452ac0ab1d1d96bb@%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rd6f6bf848c2d47fa4a85c27d011d948778b8f7e58ba495968435a0b3@%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rb674520b9f6c808c1bf263b1369e14048ec3243615f35cfd24e33604@%3cissues.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r68d029ee74ab0f3b0569d0c05f5688cb45dd3abe96a6534735252805@%3cnotifications.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r6e3d4f7991542119a4ca6330271d7fbf7b9fb3abab24ada82ddf1ee4@%3cnotifications.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r04529cedaca40c2ff90af4880493f9c88a8ebf4d1d6c861d23108a5a@%3cnotifications.zookeeper.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14040"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14040"
      },
      {
        "trust": 0.1,
        "url": "https://catalog.redhat.com/software/operators/detail/5ef2818e7dc79430ca5f4fd2"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2021:2039"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-21350"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2021:2475"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-21341"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-26258"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-21347"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-21349"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-21341"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-21342"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-21351"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-21345"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-26259"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-21342"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-21344"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-26258"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-21348"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-21348"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-21344"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-21349"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11988"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-11988"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-21350"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-21346"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-21347"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-21345"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-21343"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-21343"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-21346"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-21351"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-26259"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=appplatform\u0026downloadtype=securitypatches\u0026version=7.3"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:5344"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:4379"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_build_of_eclipse_vert.x/3.9/html/release_notes_for_eclipse_vert.x_3.9/index"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions\u0026product\\xcatrhoar.eclipse.vertx\u0026version=3.9.4"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhba-2021:1427"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-2163"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-27363"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-20305"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-3347"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2021:1429"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-27364"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-27365"
      },
      {
        "trust": 0.1,
        "url": "https://docs.openshift.com/container-platform/4.6/updating/updating-cluster"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-27363"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-3447"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-3447"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-3347"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-27365"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-27364"
      },
      {
        "trust": 0.1,
        "url": "https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-rel"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-20305"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-2163"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:5342"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:4401"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-179648"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-014030"
      },
      {
        "db": "PACKETSTORM",
        "id": "162696"
      },
      {
        "db": "PACKETSTORM",
        "id": "163201"
      },
      {
        "db": "PACKETSTORM",
        "id": "160346"
      },
      {
        "db": "PACKETSTORM",
        "id": "159973"
      },
      {
        "db": "PACKETSTORM",
        "id": "162478"
      },
      {
        "db": "PACKETSTORM",
        "id": "160349"
      },
      {
        "db": "PACKETSTORM",
        "id": "159767"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-25649"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-179648"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-25649"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-014030"
      },
      {
        "db": "PACKETSTORM",
        "id": "162696"
      },
      {
        "db": "PACKETSTORM",
        "id": "163201"
      },
      {
        "db": "PACKETSTORM",
        "id": "160346"
      },
      {
        "db": "PACKETSTORM",
        "id": "159973"
      },
      {
        "db": "PACKETSTORM",
        "id": "162478"
      },
      {
        "db": "PACKETSTORM",
        "id": "160349"
      },
      {
        "db": "PACKETSTORM",
        "id": "159767"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-25649"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-12-03T00:00:00",
        "db": "VULHUB",
        "id": "VHN-179648"
      },
      {
        "date": "2020-12-03T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-25649"
      },
      {
        "date": "2021-07-20T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-014030"
      },
      {
        "date": "2021-05-19T14:19:36",
        "db": "PACKETSTORM",
        "id": "162696"
      },
      {
        "date": "2021-06-17T18:16:15",
        "db": "PACKETSTORM",
        "id": "163201"
      },
      {
        "date": "2020-12-03T20:27:14",
        "db": "PACKETSTORM",
        "id": "160346"
      },
      {
        "date": "2020-11-09T19:20:13",
        "db": "PACKETSTORM",
        "id": "159973"
      },
      {
        "date": "2021-05-06T01:15:29",
        "db": "PACKETSTORM",
        "id": "162478"
      },
      {
        "date": "2020-12-03T20:27:59",
        "db": "PACKETSTORM",
        "id": "160349"
      },
      {
        "date": "2020-10-29T14:40:25",
        "db": "PACKETSTORM",
        "id": "159767"
      },
      {
        "date": "2020-12-03T17:15:12.503000",
        "db": "NVD",
        "id": "CVE-2020-25649"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-02-02T00:00:00",
        "db": "VULHUB",
        "id": "VHN-179648"
      },
      {
        "date": "2023-11-07T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-25649"
      },
      {
        "date": "2021-07-20T04:50:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-014030"
      },
      {
        "date": "2023-11-07T03:20:18.977000",
        "db": "NVD",
        "id": "CVE-2020-25649"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "162696"
      },
      {
        "db": "PACKETSTORM",
        "id": "160346"
      },
      {
        "db": "PACKETSTORM",
        "id": "160349"
      }
    ],
    "trust": 0.3
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "FasterXML\u00a0Jackson\u00a0Databind\u00a0 In \u00a0XML\u00a0 External entity vulnerabilities",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-014030"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "sql injection, memory leak",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "160346"
      },
      {
        "db": "PACKETSTORM",
        "id": "160349"
      }
    ],
    "trust": 0.2
  }
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "IBM Tivoli Network Manager ist eine Netzanalysesoftware f\u00fcr das Management komplexer Netze. Diese Software erfasst und verteilt Layer-2- und Layer-3-Netzdaten.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Tivoli Network Manager ausnutzen, um Dateien zu manipulieren und vertrauliche Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2022-0616 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-0616.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2022-0616 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0616"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6958056 vom 2023-02-24",
        "url": "https://www.ibm.com/support/pages/node/6958056"
      },
      {
        "category": "external",
        "summary": "IBM Security Advisory vom 2022-07-07",
        "url": "https://www.ibm.com/support/pages/node/6601919"
      },
      {
        "category": "external",
        "summary": "IBM Security Advisory vom 2022-07-07",
        "url": "https://www.ibm.com/support/pages/node/6601921"
      }
    ],
    "source_lang": "en-US",
    "title": "IBM Tivoli Network Manager: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2023-02-23T23:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:31:23.487+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2022-0616",
      "initial_release_date": "2022-07-07T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2022-07-07T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2023-02-23T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von IBM aufgenommen"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "IBM Tivoli Network Manager \u003c 4.2.0-TIV-ITNMIP-Linux-FP0015",
                "product": {
                  "name": "IBM Tivoli Network Manager \u003c 4.2.0-TIV-ITNMIP-Linux-FP0015",
                  "product_id": "T023763",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:tivoli_network_manager:4.2.0-tiv-itnmip-linux-fp0015"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "IBM Tivoli Network Manager \u003c 4.2.0-TIV-ITNMIP-zLinux-FP0015",
                "product": {
                  "name": "IBM Tivoli Network Manager \u003c 4.2.0-TIV-ITNMIP-zLinux-FP0015",
                  "product_id": "T023764",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:tivoli_network_manager:4.2.0-tiv-itnmip-zlinux-fp0015"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "IBM Tivoli Network Manager \u003c 4.2.0-TIV-ITNMIP-AIX-FP0015",
                "product": {
                  "name": "IBM Tivoli Network Manager \u003c 4.2.0-TIV-ITNMIP-AIX-FP0015",
                  "product_id": "T023765",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:tivoli_network_manager:4.2.0-tiv-itnmip-aix-fp0015"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "IBM Tivoli Network Manager 4.2.0",
                "product": {
                  "name": "IBM Tivoli Network Manager 4.2.0",
                  "product_id": "T025751",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:tivoli_network_manager:4.2.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Tivoli Network Manager"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-25649",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in IBM Tivoli Network Manager. Der Fehler besteht in der Komponente FasterXML Jackson Databind aufgrund einer schw\u00e4cheren als der erwarteten Sicherheit, die dadurch entsteht, dass die Entit\u00e4tserweiterung nicht richtig abgesichert ist. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um XML External Entity (XXE) Angriffe zu starten und die Datenintegrit\u00e4t zu beeinflussen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T025751"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2020-25649"
    },
    {
      "cve": "CVE-2021-28169",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in IBM Tivoli Network Manager. Der Fehler besteht in der Komponente Eclipse Jetty aufgrund eines Fehlers im ConcatServlet. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, indem er eine speziell gestaltete Anfrage mit einem doppelt verschl\u00fcsselten Pfad sendet, um vertrauliche Informationen offenzulegen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T025751"
        ]
      },
      "release_date": "2022-07-07T22:00:00.000+00:00",
      "title": "CVE-2021-28169"
    }
  ]
}