csaf_redhat - rhba-2020

rhba-2020_1494

Vulnerability from csaf_redhat

Published

2020-04-16 19:46

Modified

2024-11-21 20:08

Summary

Red Hat Bug Fix Advisory: Satellite 6.6.3 Async Bug Fix Update

Notes

Topic

Updated Satellite 6.6 packages that fix several bugs are now available for Red Hat Satellite.

Details

Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments. This update fixes the following bugs: * New version of the plugin is available: 0.9.4 (BZ#1812592) * [RFE] Handle host-related tasks in separate queue to avoid conflicts with user-related actions (BZ#1814424) * convert_string_to_bool doesn't deal with array type (BZ#1814425) * Publishing a new version of Content view is slow and taking huge time in Satellite 6.6. (BZ#1814426) * drpms not getting copied over cv publish (BZ#1814427) * file repo deletion is slow (BZ#1814428) * Unable to enable the tools repository for Satellite 6.6. (BZ#1818940) * satellite-installer --enable-foreman-plugin-inventory-upload still attempts to install old inventory package (BZ#1819911) Users of Red Hat Satellite are advised to upgrade to these updated packages, which fix these bugs.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated Satellite 6.6 packages that fix several bugs are now available for Red Hat Satellite.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments.\n\nThis update fixes the following bugs:\n\n* New version of the plugin is available: 0.9.4 (BZ#1812592)\n* [RFE] Handle host-related tasks in separate queue to avoid conflicts with user-related actions (BZ#1814424)\n* convert_string_to_bool doesn\u0027t deal with array type (BZ#1814425)\n* Publishing a new version of Content view is slow and taking huge time in Satellite 6.6. (BZ#1814426)\n* drpms not getting copied over cv publish (BZ#1814427)\n* file repo deletion is slow (BZ#1814428)\n* Unable to enable the tools repository for Satellite 6.6. (BZ#1818940)\n* satellite-installer --enable-foreman-plugin-inventory-upload still attempts to install old inventory package (BZ#1819911)\n\nUsers of Red Hat Satellite are advised to upgrade to these updated packages, which fix these bugs.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHBA-2020:1494",
        "url": "https://access.redhat.com/errata/RHBA-2020:1494"
      },
      {
        "category": "external",
        "summary": "1812592",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1812592"
      },
      {
        "category": "external",
        "summary": "1814424",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1814424"
      },
      {
        "category": "external",
        "summary": "1814425",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1814425"
      },
      {
        "category": "external",
        "summary": "1814426",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1814426"
      },
      {
        "category": "external",
        "summary": "1814427",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1814427"
      },
      {
        "category": "external",
        "summary": "1814428",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1814428"
      },
      {
        "category": "external",
        "summary": "1818940",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1818940"
      },
      {
        "category": "external",
        "summary": "1819911",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819911"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhba-2020_1494.json"
      }
    ],
    "title": "Red Hat Bug Fix Advisory: Satellite 6.6.3 Async Bug Fix Update",
    "tracking": {
      "current_release_date": "2024-11-21T20:08:17+00:00",
      "generator": {
        "date": "2024-11-21T20:08:17+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHBA-2020:1494",
      "initial_release_date": "2020-04-16T19:46:36+00:00",
      "revision_history": [
        {
          "date": "2020-04-16T19:46:36+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2020-04-16T19:46:36+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-21T20:08:17+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Satellite 6.6",
                "product": {
                  "name": "Red Hat Satellite 6.6",
                  "product_id": "7Server-Satellite66",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:satellite:6.6::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Satellite Capsule 6.6",
                "product": {
                  "name": "Red Hat Satellite Capsule 6.6",
                  "product_id": "7Server-Capsule66",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:satellite_capsule:6.6::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Satellite 6"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "candlepin-0:2.6.16-1.el7sat.noarch",
                "product": {
                  "name": "candlepin-0:2.6.16-1.el7sat.noarch",
                  "product_id": "candlepin-0:2.6.16-1.el7sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/candlepin@2.6.16-1.el7sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "candlepin-selinux-0:2.6.16-1.el7sat.noarch",
                "product": {
                  "name": "candlepin-selinux-0:2.6.16-1.el7sat.noarch",
                  "product_id": "candlepin-selinux-0:2.6.16-1.el7sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/candlepin-selinux@2.6.16-1.el7sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "foreman-0:1.22.0.39-2.el7sat.noarch",
                "product": {
                  "name": "foreman-0:1.22.0.39-2.el7sat.noarch",
                  "product_id": "foreman-0:1.22.0.39-2.el7sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/foreman@1.22.0.39-2.el7sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "foreman-cli-0:1.22.0.39-2.el7sat.noarch",
                "product": {
                  "name": "foreman-cli-0:1.22.0.39-2.el7sat.noarch",
                  "product_id": "foreman-cli-0:1.22.0.39-2.el7sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/foreman-cli@1.22.0.39-2.el7sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "foreman-debug-0:1.22.0.39-2.el7sat.noarch",
                "product": {
                  "name": "foreman-debug-0:1.22.0.39-2.el7sat.noarch",
                  "product_id": "foreman-debug-0:1.22.0.39-2.el7sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/foreman-debug@1.22.0.39-2.el7sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
                "product": {
                  "name": "foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
                  "product_id": "foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/foreman-ec2@1.22.0.39-2.el7sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "foreman-gce-0:1.22.0.39-2.el7sat.noarch",
                "product": {
                  "name": "foreman-gce-0:1.22.0.39-2.el7sat.noarch",
                  "product_id": "foreman-gce-0:1.22.0.39-2.el7sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/foreman-gce@1.22.0.39-2.el7sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "foreman-journald-0:1.22.0.39-2.el7sat.noarch",
                "product": {
                  "name": "foreman-journald-0:1.22.0.39-2.el7sat.noarch",
                  "product_id": "foreman-journald-0:1.22.0.39-2.el7sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/foreman-journald@1.22.0.39-2.el7sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
                "product": {
                  "name": "foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
                  "product_id": "foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/foreman-libvirt@1.22.0.39-2.el7sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
                "product": {
                  "name": "foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
                  "product_id": "foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/foreman-openstack@1.22.0.39-2.el7sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
                "product": {
                  "name": "foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
                  "product_id": "foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/foreman-ovirt@1.22.0.39-2.el7sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
                "product": {
                  "name": "foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
                  "product_id": "foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/foreman-postgresql@1.22.0.39-2.el7sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
                "product": {
                  "name": "foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
                  "product_id": "foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/foreman-rackspace@1.22.0.39-2.el7sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
                "product": {
                  "name": "foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
                  "product_id": "foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/foreman-telemetry@1.22.0.39-2.el7sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
                "product": {
                  "name": "foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
                  "product_id": "foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/foreman-vmware@1.22.0.39-2.el7sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "satellite-0:6.6.3-1.el7sat.noarch",
                "product": {
                  "name": "satellite-0:6.6.3-1.el7sat.noarch",
                  "product_id": "satellite-0:6.6.3-1.el7sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/satellite@6.6.3-1.el7sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "satellite-capsule-0:6.6.3-1.el7sat.noarch",
                "product": {
                  "name": "satellite-capsule-0:6.6.3-1.el7sat.noarch",
                  "product_id": "satellite-capsule-0:6.6.3-1.el7sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/satellite-capsule@6.6.3-1.el7sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "satellite-cli-0:6.6.3-1.el7sat.noarch",
                "product": {
                  "name": "satellite-cli-0:6.6.3-1.el7sat.noarch",
                  "product_id": "satellite-cli-0:6.6.3-1.el7sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/satellite-cli@6.6.3-1.el7sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "satellite-common-0:6.6.3-1.el7sat.noarch",
                "product": {
                  "name": "satellite-common-0:6.6.3-1.el7sat.noarch",
                  "product_id": "satellite-common-0:6.6.3-1.el7sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/satellite-common@6.6.3-1.el7sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
                "product": {
                  "name": "satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
                  "product_id": "satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/satellite-debug-tools@6.6.3-1.el7sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
                "product": {
                  "name": "tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
                  "product_id": "tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tfm-rubygem-fog-ovirt@1.2.3-1.el7sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
                "product": {
                  "name": "tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
                  "product_id": "tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tfm-rubygem-foreman_rh_cloud@0.9.4.1-2.el7sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
                "product": {
                  "name": "tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
                  "product_id": "tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tfm-rubygem-katello@3.12.0.41-1.el7sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
                "product": {
                  "name": "tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
                  "product_id": "tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tfm-rubygem-runcible@2.13.0-1.el7sat?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "candlepin-0:2.6.16-1.el7sat.src",
                "product": {
                  "name": "candlepin-0:2.6.16-1.el7sat.src",
                  "product_id": "candlepin-0:2.6.16-1.el7sat.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/candlepin@2.6.16-1.el7sat?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "foreman-0:1.22.0.39-2.el7sat.src",
                "product": {
                  "name": "foreman-0:1.22.0.39-2.el7sat.src",
                  "product_id": "foreman-0:1.22.0.39-2.el7sat.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/foreman@1.22.0.39-2.el7sat?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "satellite-0:6.6.3-1.el7sat.src",
                "product": {
                  "name": "satellite-0:6.6.3-1.el7sat.src",
                  "product_id": "satellite-0:6.6.3-1.el7sat.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/satellite@6.6.3-1.el7sat?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
                "product": {
                  "name": "tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
                  "product_id": "tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tfm-rubygem-fog-ovirt@1.2.3-1.el7sat?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
                "product": {
                  "name": "tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
                  "product_id": "tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tfm-rubygem-foreman_rh_cloud@0.9.4.1-2.el7sat?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
                "product": {
                  "name": "tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
                  "product_id": "tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tfm-rubygem-katello@3.12.0.41-1.el7sat?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tfm-rubygem-runcible-0:2.13.0-1.el7sat.src",
                "product": {
                  "name": "tfm-rubygem-runcible-0:2.13.0-1.el7sat.src",
                  "product_id": "tfm-rubygem-runcible-0:2.13.0-1.el7sat.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tfm-rubygem-runcible@2.13.0-1.el7sat?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite Capsule 6.6",
          "product_id": "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Capsule66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-0:1.22.0.39-2.el7sat.src as a component of Red Hat Satellite Capsule 6.6",
          "product_id": "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src"
        },
        "product_reference": "foreman-0:1.22.0.39-2.el7sat.src",
        "relates_to_product_reference": "7Server-Capsule66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-cli-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite Capsule 6.6",
          "product_id": "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-cli-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Capsule66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-debug-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite Capsule 6.6",
          "product_id": "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-debug-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Capsule66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-ec2-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite Capsule 6.6",
          "product_id": "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Capsule66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-gce-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite Capsule 6.6",
          "product_id": "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-gce-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Capsule66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-journald-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite Capsule 6.6",
          "product_id": "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-journald-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Capsule66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-libvirt-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite Capsule 6.6",
          "product_id": "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Capsule66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-openstack-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite Capsule 6.6",
          "product_id": "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Capsule66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-ovirt-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite Capsule 6.6",
          "product_id": "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Capsule66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-postgresql-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite Capsule 6.6",
          "product_id": "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Capsule66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-rackspace-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite Capsule 6.6",
          "product_id": "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Capsule66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-telemetry-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite Capsule 6.6",
          "product_id": "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Capsule66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-vmware-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite Capsule 6.6",
          "product_id": "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Capsule66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-0:6.6.3-1.el7sat.noarch as a component of Red Hat Satellite Capsule 6.6",
          "product_id": "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch"
        },
        "product_reference": "satellite-0:6.6.3-1.el7sat.noarch",
        "relates_to_product_reference": "7Server-Capsule66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-0:6.6.3-1.el7sat.src as a component of Red Hat Satellite Capsule 6.6",
          "product_id": "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src"
        },
        "product_reference": "satellite-0:6.6.3-1.el7sat.src",
        "relates_to_product_reference": "7Server-Capsule66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-capsule-0:6.6.3-1.el7sat.noarch as a component of Red Hat Satellite Capsule 6.6",
          "product_id": "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch"
        },
        "product_reference": "satellite-capsule-0:6.6.3-1.el7sat.noarch",
        "relates_to_product_reference": "7Server-Capsule66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-cli-0:6.6.3-1.el7sat.noarch as a component of Red Hat Satellite Capsule 6.6",
          "product_id": "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch"
        },
        "product_reference": "satellite-cli-0:6.6.3-1.el7sat.noarch",
        "relates_to_product_reference": "7Server-Capsule66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-common-0:6.6.3-1.el7sat.noarch as a component of Red Hat Satellite Capsule 6.6",
          "product_id": "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch"
        },
        "product_reference": "satellite-common-0:6.6.3-1.el7sat.noarch",
        "relates_to_product_reference": "7Server-Capsule66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-debug-tools-0:6.6.3-1.el7sat.noarch as a component of Red Hat Satellite Capsule 6.6",
          "product_id": "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch"
        },
        "product_reference": "satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
        "relates_to_product_reference": "7Server-Capsule66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "candlepin-0:2.6.16-1.el7sat.noarch as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch"
        },
        "product_reference": "candlepin-0:2.6.16-1.el7sat.noarch",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "candlepin-0:2.6.16-1.el7sat.src as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src"
        },
        "product_reference": "candlepin-0:2.6.16-1.el7sat.src",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "candlepin-selinux-0:2.6.16-1.el7sat.noarch as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch"
        },
        "product_reference": "candlepin-selinux-0:2.6.16-1.el7sat.noarch",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-0:1.22.0.39-2.el7sat.src as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src"
        },
        "product_reference": "foreman-0:1.22.0.39-2.el7sat.src",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-cli-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-cli-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-debug-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-debug-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-ec2-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-gce-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-gce-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-journald-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-journald-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-libvirt-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-openstack-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-ovirt-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-postgresql-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-rackspace-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-telemetry-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-vmware-0:1.22.0.39-2.el7sat.noarch as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch"
        },
        "product_reference": "foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-0:6.6.3-1.el7sat.noarch as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch"
        },
        "product_reference": "satellite-0:6.6.3-1.el7sat.noarch",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-0:6.6.3-1.el7sat.src as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src"
        },
        "product_reference": "satellite-0:6.6.3-1.el7sat.src",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-capsule-0:6.6.3-1.el7sat.noarch as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch"
        },
        "product_reference": "satellite-capsule-0:6.6.3-1.el7sat.noarch",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-cli-0:6.6.3-1.el7sat.noarch as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch"
        },
        "product_reference": "satellite-cli-0:6.6.3-1.el7sat.noarch",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-common-0:6.6.3-1.el7sat.noarch as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch"
        },
        "product_reference": "satellite-common-0:6.6.3-1.el7sat.noarch",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-debug-tools-0:6.6.3-1.el7sat.noarch as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch"
        },
        "product_reference": "satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch"
        },
        "product_reference": "tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src"
        },
        "product_reference": "tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch"
        },
        "product_reference": "tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src"
        },
        "product_reference": "tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch"
        },
        "product_reference": "tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src"
        },
        "product_reference": "tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch"
        },
        "product_reference": "tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
        "relates_to_product_reference": "7Server-Satellite66"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tfm-rubygem-runcible-0:2.13.0-1.el7sat.src as a component of Red Hat Satellite 6.6",
          "product_id": "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
        },
        "product_reference": "tfm-rubygem-runcible-0:2.13.0-1.el7sat.src",
        "relates_to_product_reference": "7Server-Satellite66"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-12086",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2019-05-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1713468"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server.",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Satellite 6 does not enable polymorphic unmarshmalling, which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
          "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-12086"
        },
        {
          "category": "external",
          "summary": "RHBZ#1713468",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1713468"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-12086",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-12086"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-12086",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12086"
        }
      ],
      "release_date": "2019-05-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-04-16T19:46:36+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.6/html/upgrading_and_updating_red_hat_satellite/updating_satellite_server_capsule_server_and_content_hosts",
          "product_ids": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2020:1494"
        },
        {
          "category": "workaround",
          "details": "The following conditions are needed for an exploit, we recommend avoiding all if possible\n\n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
          "product_ids": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 0.0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server."
    },
    {
      "cve": "CVE-2019-20330",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2020-01-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1793154"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: lacks certain net.sf.ehcache blocking",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "While OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
          "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-20330"
        },
        {
          "category": "external",
          "summary": "RHBZ#1793154",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1793154"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-20330",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-20330"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-20330",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20330"
        }
      ],
      "release_date": "2020-01-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-04-16T19:46:36+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.6/html/upgrading_and_updating_red_hat_satellite/updating_satellite_server_capsule_server_and_content_hosts",
          "product_ids": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2020:1494"
        },
        {
          "category": "workaround",
          "details": "The following conditions are needed for an exploit, we recommend avoiding all if possible:\n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
          "product_ids": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "jackson-databind: lacks certain net.sf.ehcache blocking"
    },
    {
      "cve": "CVE-2020-8840",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2020-03-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1816330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FasterXML jackson-databind in versions 2.0.0 through 2.9.10.2. A \"gadget\" exploit is possible due to a lack of a Java object being blocking from being deserialized. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: Lacks certain xbean-reflect/JNDI blocking",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nWhile OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
          "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-8840"
        },
        {
          "category": "external",
          "summary": "RHBZ#1816330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816330"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8840",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-8840"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8840",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8840"
        }
      ],
      "release_date": "2020-03-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-04-16T19:46:36+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.6/html/upgrading_and_updating_red_hat_satellite/updating_satellite_server_capsule_server_and_content_hosts",
          "product_ids": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2020:1494"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 0.0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "jackson-databind: Lacks certain xbean-reflect/JNDI blocking"
    },
    {
      "cve": "CVE-2020-9546",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2020-03-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1816332"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: Serialization gadgets in shaded-hikari-config",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nWhile OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
          "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-9546"
        },
        {
          "category": "external",
          "summary": "RHBZ#1816332",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816332"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-9546",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-9546"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-9546",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9546"
        }
      ],
      "release_date": "2020-03-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-04-16T19:46:36+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.6/html/upgrading_and_updating_red_hat_satellite/updating_satellite_server_capsule_server_and_content_hosts",
          "product_ids": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2020:1494"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 0.0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "jackson-databind: Serialization gadgets in shaded-hikari-config"
    },
    {
      "cve": "CVE-2020-9547",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2020-03-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1816337"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind 2.x. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: Serialization gadgets in ibatis-sqlmap",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nWhile OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
          "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-9547"
        },
        {
          "category": "external",
          "summary": "RHBZ#1816337",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816337"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-9547",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-9547"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-9547",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9547"
        }
      ],
      "release_date": "2020-03-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-04-16T19:46:36+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.6/html/upgrading_and_updating_red_hat_satellite/updating_satellite_server_capsule_server_and_content_hosts",
          "product_ids": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2020:1494"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 0.0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "jackson-databind: Serialization gadgets in ibatis-sqlmap"
    },
    {
      "cve": "CVE-2020-9548",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2020-03-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1816340"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind 2.x. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: Serialization gadgets in anteros-core",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nWhile OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
          "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-9548"
        },
        {
          "category": "external",
          "summary": "RHBZ#1816340",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816340"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-9548",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-9548"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-9548",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9548"
        }
      ],
      "release_date": "2020-03-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-04-16T19:46:36+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.6/html/upgrading_and_updating_red_hat_satellite/updating_satellite_server_capsule_server_and_content_hosts",
          "product_ids": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2020:1494"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 0.0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "jackson-databind: Serialization gadgets in anteros-core"
    },
    {
      "cve": "CVE-2020-10968",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2020-03-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1819208"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind 2.x prior to version 2.9.10.4.  The interaction between serialization gadgets and typing is mishandled in the bus-proxy. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "While OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.\n\nThe PKI module as shipped in Red Hat Enterprise Linux 8 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used, lowering the impact of the vulnerability for the Product. We may update the jackson-databind dependency in a future release.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
          "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-10968"
        },
        {
          "category": "external",
          "summary": "RHBZ#1819208",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819208"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-10968",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-10968"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10968",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10968"
        }
      ],
      "release_date": "2020-03-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-04-16T19:46:36+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.6/html/upgrading_and_updating_red_hat_satellite/updating_satellite_server_capsule_server_and_content_hosts",
          "product_ids": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2020:1494"
        },
        {
          "category": "workaround",
          "details": "The following conditions are needed for an exploit, we recommend avoiding all if possible\n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
          "product_ids": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 0.0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider"
    },
    {
      "cve": "CVE-2020-10969",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2020-03-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1819212"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: Serialization gadgets in javax.swing.JEditorPane",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "While OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.\n\nThe PKI module as shipped in Red Hat Enterprise Linux 8 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used, lowering the impact of the vulnerability for the Product. We may update the jackson-databind dependency in a future release.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
          "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-10969"
        },
        {
          "category": "external",
          "summary": "RHBZ#1819212",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819212"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-10969",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-10969"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10969",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10969"
        }
      ],
      "release_date": "2020-03-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-04-16T19:46:36+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.6/html/upgrading_and_updating_red_hat_satellite/updating_satellite_server_capsule_server_and_content_hosts",
          "product_ids": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2020:1494"
        },
        {
          "category": "workaround",
          "details": "The following conditions are needed for an exploit, we recommend avoiding all if possible\n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
          "product_ids": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 0.0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "jackson-databind: Serialization gadgets in javax.swing.JEditorPane"
    },
    {
      "cve": "CVE-2020-11619",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2020-04-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1826805"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind 2.x. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: Serialization gadgets in org.springframework:spring-aop",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nThe PKI module as shipped in Red Hat Enterprise Linux 8 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used, lowering the impact of the vulnerability for the Product. We may update the jackson-databind dependency in a future release.\n\nWhile OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
          "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-11619"
        },
        {
          "category": "external",
          "summary": "RHBZ#1826805",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1826805"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11619",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-11619"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11619",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11619"
        }
      ],
      "release_date": "2020-04-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-04-16T19:46:36+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.6/html/upgrading_and_updating_red_hat_satellite/updating_satellite_server_capsule_server_and_content_hosts",
          "product_ids": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2020:1494"
        },
        {
          "category": "workaround",
          "details": "The following conditions are needed for an exploit, we recommend avoiding all if possible:\n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
          "product_ids": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 0.0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "jackson-databind: Serialization gadgets in org.springframework:spring-aop"
    },
    {
      "cve": "CVE-2020-14060",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2020-06-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1848960"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.5. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: serialization in oadd.org.apache.xalan.lib.sql.JNDIConnectionPool",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "While OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nThe PKI module as shipped in Red Hat Enterprise Linux 8 and Red Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used, lowering the impact of the vulnerability for the Product. We may update the jackson-databind dependency in a future release.\n\nThe version of jackson-databind as shipped in Red Hat Software Collections rh-maven35 is used only while building maven, thus it does not deserialize data coming from untrusted sources, lowering the impact of the vulnerability for the Product.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
          "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-14060"
        },
        {
          "category": "external",
          "summary": "RHBZ#1848960",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848960"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-14060",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-14060"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14060",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14060"
        }
      ],
      "release_date": "2020-05-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-04-16T19:46:36+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.6/html/upgrading_and_updating_red_hat_satellite/updating_satellite_server_capsule_server_and_content_hosts",
          "product_ids": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2020:1494"
        },
        {
          "category": "workaround",
          "details": "The following conditions are needed for an exploit, we recommend avoiding all if possible:\n* Deserialization from sources you do not control\n* enableDefaultTyping()\n* @JsonTypeInfo using id.CLASS or id.MINIMAL_CLASS\n* oadd.org.apache.xalan.lib.sql.JNDIConnectionPool in classpath",
          "product_ids": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: serialization in oadd.org.apache.xalan.lib.sql.JNDIConnectionPool"
    },
    {
      "cve": "CVE-2020-14061",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2020-06-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1848966"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.5. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: serialization in weblogic/oracle-aqjms",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "While OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nThe PKI module as shipped in Red Hat Enterprise Linux 8 and Red Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used, lowering the impact of the vulnerability for the Product. We may update the jackson-databind dependency in a future release.\n\nThe version of jackson-databind as shipped in Red Hat Software Collections rh-maven35 is used only while building maven, thus it does not deserialize data coming from untrusted sources, lowering the impact of the vulnerability for the Product.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
          "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-14061"
        },
        {
          "category": "external",
          "summary": "RHBZ#1848966",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848966"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-14061",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-14061"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14061",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14061"
        }
      ],
      "release_date": "2020-05-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-04-16T19:46:36+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.6/html/upgrading_and_updating_red_hat_satellite/updating_satellite_server_capsule_server_and_content_hosts",
          "product_ids": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2020:1494"
        },
        {
          "category": "workaround",
          "details": "The following conditions are needed for an exploit, we recommend avoiding all if possible:\n* Deserialization from sources you do not control\n* enableDefaultTyping()\n* @JsonTypeInfo using id.CLASS or id.MINIMAL_CLASS\n* oracle.jms.AQjms*ConnectionFactory in classpath",
          "product_ids": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "jackson-databind: serialization in weblogic/oracle-aqjms"
    },
    {
      "cve": "CVE-2020-14062",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2020-06-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1848962"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.5. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: serialization in com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "While OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nThe PKI module as shipped in Red Hat Enterprise Linux 8 and Red Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used, lowering the impact of the vulnerability for the Product. We may update the jackson-databind dependency in a future release.\n\nThe version of jackson-databind as shipped in Red Hat Software Collections rh-maven35 is used only while building maven, thus it does not deserialize data coming from untrusted sources, lowering the impact of the vulnerability for the Product.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
          "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-14062"
        },
        {
          "category": "external",
          "summary": "RHBZ#1848962",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848962"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-14062",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-14062"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14062",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14062"
        }
      ],
      "release_date": "2020-05-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-04-16T19:46:36+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.6/html/upgrading_and_updating_red_hat_satellite/updating_satellite_server_capsule_server_and_content_hosts",
          "product_ids": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2020:1494"
        },
        {
          "category": "workaround",
          "details": "The following conditions are needed for an exploit, we recommend avoiding all if possible:\n* Deserialization from sources you do not control\n* enableDefaultTyping()\n* @JsonTypeInfo using id.CLASS or id.MINIMAL_CLASS\n* com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool in classpath",
          "product_ids": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "jackson-databind: serialization in com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool"
    },
    {
      "cve": "CVE-2020-14195",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2020-06-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1848958"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.5. FasterXML jackson-databind mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: serialization in org.jsecurity.realm.jndi.JndiRealmFactory",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "While OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nThe PKI module as shipped in Red Hat Enterprise Linux 8 and Red Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used, lowering the impact of the vulnerability for the Product. We may update the jackson-databind dependency in a future release.\n\nThe version of jackson-databind as shipped in Red Hat Software Collections rh-maven35 is used only while building maven, thus it does not deserialize data coming from untrusted sources, lowering the impact of the vulnerability for the Product.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
          "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
          "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
          "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
          "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-14195"
        },
        {
          "category": "external",
          "summary": "RHBZ#1848958",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848958"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-14195",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-14195"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14195",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14195"
        }
      ],
      "release_date": "2020-06-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-04-16T19:46:36+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.6/html/upgrading_and_updating_red_hat_satellite/updating_satellite_server_capsule_server_and_content_hosts",
          "product_ids": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2020:1494"
        },
        {
          "category": "workaround",
          "details": "The following conditions are needed for an exploit, we recommend avoiding all if possible:\n* Deserialization from sources you do not control\n* enableDefaultTyping()\n* @JsonTypeInfo using id.CLASS or id.MINIMAL_CLASS\n* org.jsecurity.realm.jndi.JndiRealmFactory in classpath",
          "product_ids": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Capsule66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Capsule66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Capsule66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:candlepin-0:2.6.16-1.el7sat.src",
            "7Server-Satellite66:candlepin-selinux-0:2.6.16-1.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-0:1.22.0.39-2.el7sat.src",
            "7Server-Satellite66:foreman-cli-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-debug-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ec2-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-gce-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-journald-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-libvirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-openstack-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-ovirt-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-postgresql-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-rackspace-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-telemetry-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:foreman-vmware-0:1.22.0.39-2.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-0:6.6.3-1.el7sat.src",
            "7Server-Satellite66:satellite-capsule-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-cli-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-common-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:satellite-debug-tools-0:6.6.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-katello-0:3.12.0.41-1.el7sat.src",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.noarch",
            "7Server-Satellite66:tfm-rubygem-runcible-0:2.13.0-1.el7sat.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "jackson-databind: serialization in org.jsecurity.realm.jndi.JndiRealmFactory"
    }
  ]
}

cve-2020-9546

Vulnerability from cvelistv5

Published

2020-03-02 03:59

Modified

2024-08-04 10:34

Severity ?

Summary

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

References

▼	URL	Tags
	https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://github.com/FasterXML/jackson-databind/issues/2631	x_refsource_MISC
	https://lists.apache.org/thread.html/r893a0104e50c1c2559eb9a5812add28ae8c3e5f43712947a9847ec18%40%3Cnotifications.zookeeper.apache.org%3E	x_refsource_MISC
	https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20200904-0006/	x_refsource_CONFIRM
	https://www.oracle.com/security-alerts/cpujan2021.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:34:39.829Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[debian-lts-announce] 20200305 [SECURITY] [DLA 2135-1] jackson-databind security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html"
          },
          {
            "name": "[zookeeper-issues] 20200307 [jira] [Created] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-dev] 20200307 [jira] [Created] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200307 [jira] [Updated] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200308 [jira] [Commented] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200319 [jira] [Commented] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200319 [jira] [Updated] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200430 [jira] [Resolved] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/FasterXML/jackson-databind/issues/2631"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r893a0104e50c1c2559eb9a5812add28ae8c3e5f43712947a9847ec18%40%3Cnotifications.zookeeper.apache.org%3E"
          },
          {
            "name": "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200904-0006/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-20T10:40:28",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[debian-lts-announce] 20200305 [SECURITY] [DLA 2135-1] jackson-databind security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html"
        },
        {
          "name": "[zookeeper-issues] 20200307 [jira] [Created] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-dev] 20200307 [jira] [Created] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200307 [jira] [Updated] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200308 [jira] [Commented] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200319 [jira] [Commented] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200319 [jira] [Updated] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200430 [jira] [Resolved] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/issues/2631"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread.html/r893a0104e50c1c2559eb9a5812add28ae8c3e5f43712947a9847ec18%40%3Cnotifications.zookeeper.apache.org%3E"
        },
        {
          "name": "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200904-0006/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-9546",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[debian-lts-announce] 20200305 [SECURITY] [DLA 2135-1] jackson-databind security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html"
            },
            {
              "name": "[zookeeper-issues] 20200307 [jira] [Created] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-dev] 20200307 [jira] [Created] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1@%3Cdev.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200307 [jira] [Updated] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200308 [jira] [Commented] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200319 [jira] [Commented] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200319 [jira] [Updated] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200430 [jira] [Resolved] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062",
              "refsource": "MISC",
              "url": "https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
            },
            {
              "name": "https://github.com/FasterXML/jackson-databind/issues/2631",
              "refsource": "MISC",
              "url": "https://github.com/FasterXML/jackson-databind/issues/2631"
            },
            {
              "name": "https://lists.apache.org/thread.html/r893a0104e50c1c2559eb9a5812add28ae8c3e5f43712947a9847ec18@%3Cnotifications.zookeeper.apache.org%3E",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread.html/r893a0104e50c1c2559eb9a5812add28ae8c3e5f43712947a9847ec18@%3Cnotifications.zookeeper.apache.org%3E"
            },
            {
              "name": "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200904-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200904-0006/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-9546",
    "datePublished": "2020-03-02T03:59:18",
    "dateReserved": "2020-03-02T00:00:00",
    "dateUpdated": "2024-08-04T10:34:39.829Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2019-12086

Vulnerability from cvelistv5

Published

2019-05-17 16:57

Modified

2024-08-04 23:10

Severity ?

Summary

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.

References

▼	URL	Tags
	https://lists.apache.org/thread.html/88cd25375805950ae7337e669b0cb0eeda98b9604c1b8d806dccbad2%40%3Creviews.spark.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2019/05/msg00030.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2019/dsa-4452	vendor-advisory, x_refsource_DEBIAN
	https://seclists.org/bugtraq/2019/May/68	mailing-list, x_refsource_BUGTRAQ
	http://www.securityfocus.com/bid/109227	vdb-entry, x_refsource_BID
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/	vendor-advisory, x_refsource_FEDORA
	https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592%40%3Ccommits.cassandra.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/	vendor-advisory, x_refsource_FEDORA
	https://access.redhat.com/errata/RHSA-2019:2858	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2019:2937	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2019:2935	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2019:2936	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2019:2938	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2019:2998	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2019:3044	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2019:3045	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2019:3050	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2019:3046	vendor-advisory, x_refsource_REDHAT
	https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E	mailing-list, x_refsource_MLIST
	https://access.redhat.com/errata/RHSA-2019:3149	vendor-advisory, x_refsource_REDHAT
	https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E	mailing-list, x_refsource_MLIST
	https://access.redhat.com/errata/RHSA-2019:3200	vendor-advisory, x_refsource_REDHAT
	https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E	mailing-list, x_refsource_MLIST
	https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuapr2020.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html	x_refsource_MISC
	https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujan2020.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20190530-0003/	x_refsource_CONFIRM
	http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/	x_refsource_MISC
	https://github.com/FasterXML/jackson-databind/issues/2326	x_refsource_MISC
	https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.9	x_refsource_CONFIRM
	https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuApr2021.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:10:30.184Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[spark-reviews] 20190520 [GitHub] [spark] Fokko opened a new pull request #24646: Spark 27757",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/88cd25375805950ae7337e669b0cb0eeda98b9604c1b8d806dccbad2%40%3Creviews.spark.apache.org%3E"
          },
          {
            "name": "[debian-lts-announce] 20190521 [SECURITY] [DLA 1798-1] jackson-databind security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00030.html"
          },
          {
            "name": "DSA-4452",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4452"
          },
          {
            "name": "20190527 [SECURITY] [DSA 4452-1] jackson-databind security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/May/68"
          },
          {
            "name": "109227",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/109227"
          },
          {
            "name": "FEDORA-2019-99ff6aa32c",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/"
          },
          {
            "name": "[cassandra-commits] 20190919 [jira] [Created] (CASSANDRA-15328) Bump jackson version to \u003e= 2.9.9.3 to address security vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592%40%3Ccommits.cassandra.apache.org%3E"
          },
          {
            "name": "FEDORA-2019-ae6a703b8f",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/"
          },
          {
            "name": "FEDORA-2019-fb23eccc03",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/"
          },
          {
            "name": "RHSA-2019:2858",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2858"
          },
          {
            "name": "RHSA-2019:2937",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2937"
          },
          {
            "name": "RHSA-2019:2935",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2935"
          },
          {
            "name": "RHSA-2019:2936",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2936"
          },
          {
            "name": "RHSA-2019:2938",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2938"
          },
          {
            "name": "RHSA-2019:2998",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2998"
          },
          {
            "name": "RHSA-2019:3044",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3044"
          },
          {
            "name": "RHSA-2019:3045",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3045"
          },
          {
            "name": "RHSA-2019:3050",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3050"
          },
          {
            "name": "RHSA-2019:3046",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3046"
          },
          {
            "name": "[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E"
          },
          {
            "name": "RHSA-2019:3149",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3149"
          },
          {
            "name": "[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E"
          },
          {
            "name": "[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E"
          },
          {
            "name": "RHSA-2019:3200",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3200"
          },
          {
            "name": "[nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E"
          },
          {
            "name": "[nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E"
          },
          {
            "name": "[lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20190530-0003/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/FasterXML/jackson-databind/issues/2326"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.9"
          },
          {
            "name": "[nifi-commits] 20200930 svn commit: r1882168 - /nifi/site/trunk/security.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-19T23:19:56",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[spark-reviews] 20190520 [GitHub] [spark] Fokko opened a new pull request #24646: Spark 27757",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/88cd25375805950ae7337e669b0cb0eeda98b9604c1b8d806dccbad2%40%3Creviews.spark.apache.org%3E"
        },
        {
          "name": "[debian-lts-announce] 20190521 [SECURITY] [DLA 1798-1] jackson-databind security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00030.html"
        },
        {
          "name": "DSA-4452",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4452"
        },
        {
          "name": "20190527 [SECURITY] [DSA 4452-1] jackson-databind security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2019/May/68"
        },
        {
          "name": "109227",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/109227"
        },
        {
          "name": "FEDORA-2019-99ff6aa32c",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/"
        },
        {
          "name": "[cassandra-commits] 20190919 [jira] [Created] (CASSANDRA-15328) Bump jackson version to \u003e= 2.9.9.3 to address security vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592%40%3Ccommits.cassandra.apache.org%3E"
        },
        {
          "name": "FEDORA-2019-ae6a703b8f",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/"
        },
        {
          "name": "FEDORA-2019-fb23eccc03",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/"
        },
        {
          "name": "RHSA-2019:2858",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2858"
        },
        {
          "name": "RHSA-2019:2937",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2937"
        },
        {
          "name": "RHSA-2019:2935",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2935"
        },
        {
          "name": "RHSA-2019:2936",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2936"
        },
        {
          "name": "RHSA-2019:2938",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2938"
        },
        {
          "name": "RHSA-2019:2998",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2998"
        },
        {
          "name": "RHSA-2019:3044",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3044"
        },
        {
          "name": "RHSA-2019:3045",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3045"
        },
        {
          "name": "RHSA-2019:3050",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3050"
        },
        {
          "name": "RHSA-2019:3046",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3046"
        },
        {
          "name": "[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E"
        },
        {
          "name": "RHSA-2019:3149",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3149"
        },
        {
          "name": "[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E"
        },
        {
          "name": "[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E"
        },
        {
          "name": "RHSA-2019:3200",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3200"
        },
        {
          "name": "[nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E"
        },
        {
          "name": "[nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E"
        },
        {
          "name": "[lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20190530-0003/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/issues/2326"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.9"
        },
        {
          "name": "[nifi-commits] 20200930 svn commit: r1882168 - /nifi/site/trunk/security.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-12086",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[spark-reviews] 20190520 [GitHub] [spark] Fokko opened a new pull request #24646: Spark 27757",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/88cd25375805950ae7337e669b0cb0eeda98b9604c1b8d806dccbad2@%3Creviews.spark.apache.org%3E"
            },
            {
              "name": "[debian-lts-announce] 20190521 [SECURITY] [DLA 1798-1] jackson-databind security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00030.html"
            },
            {
              "name": "DSA-4452",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2019/dsa-4452"
            },
            {
              "name": "20190527 [SECURITY] [DSA 4452-1] jackson-databind security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2019/May/68"
            },
            {
              "name": "109227",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/109227"
            },
            {
              "name": "FEDORA-2019-99ff6aa32c",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/"
            },
            {
              "name": "[cassandra-commits] 20190919 [jira] [Created] (CASSANDRA-15328) Bump jackson version to \u003e= 2.9.9.3 to address security vulnerabilities",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592@%3Ccommits.cassandra.apache.org%3E"
            },
            {
              "name": "FEDORA-2019-ae6a703b8f",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/"
            },
            {
              "name": "FEDORA-2019-fb23eccc03",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/"
            },
            {
              "name": "RHSA-2019:2858",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2858"
            },
            {
              "name": "RHSA-2019:2937",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2937"
            },
            {
              "name": "RHSA-2019:2935",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2935"
            },
            {
              "name": "RHSA-2019:2936",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2936"
            },
            {
              "name": "RHSA-2019:2938",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2938"
            },
            {
              "name": "RHSA-2019:2998",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2998"
            },
            {
              "name": "RHSA-2019:3044",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:3044"
            },
            {
              "name": "RHSA-2019:3045",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:3045"
            },
            {
              "name": "RHSA-2019:3050",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:3050"
            },
            {
              "name": "RHSA-2019:3046",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:3046"
            },
            {
              "name": "[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E"
            },
            {
              "name": "RHSA-2019:3149",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:3149"
            },
            {
              "name": "[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E"
            },
            {
              "name": "[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E"
            },
            {
              "name": "RHSA-2019:3200",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:3200"
            },
            {
              "name": "[nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E"
            },
            {
              "name": "[nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E"
            },
            {
              "name": "[lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3E"
            },
            {
              "name": "https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062",
              "refsource": "MISC",
              "url": "https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
            },
            {
              "name": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
            },
            {
              "name": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20190530-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20190530-0003/"
            },
            {
              "name": "http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/",
              "refsource": "MISC",
              "url": "http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/"
            },
            {
              "name": "https://github.com/FasterXML/jackson-databind/issues/2326",
              "refsource": "MISC",
              "url": "https://github.com/FasterXML/jackson-databind/issues/2326"
            },
            {
              "name": "https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.9",
              "refsource": "CONFIRM",
              "url": "https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.9"
            },
            {
              "name": "[nifi-commits] 20200930 svn commit: r1882168 - /nifi/site/trunk/security.html",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679@%3Ccommits.nifi.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-12086",
    "datePublished": "2019-05-17T16:57:05",
    "dateReserved": "2019-05-13T00:00:00",
    "dateUpdated": "2024-08-04T23:10:30.184Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2020-14061

Vulnerability from cvelistv5

Published

2020-06-14 19:42

Modified

2024-08-04 12:32

Severity ?

Summary

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).

References

▼	URL	Tags
	https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062	x_refsource_MISC
	https://github.com/FasterXML/jackson-databind/issues/2698	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20200702-0003/	x_refsource_CONFIRM
	https://www.oracle.com/security-alerts/cpujan2021.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuApr2021.html	x_refsource_MISC
	https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:32:14.691Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/FasterXML/jackson-databind/issues/2698"
          },
          {
            "name": "[debian-lts-announce] 20200701 [SECURITY] [DLA 2270-1] jackson-databind security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200702-0003/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-20T10:39:09",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/issues/2698"
        },
        {
          "name": "[debian-lts-announce] 20200701 [SECURITY] [DLA 2270-1] jackson-databind security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200702-0003/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-14061",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062",
              "refsource": "MISC",
              "url": "https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
            },
            {
              "name": "https://github.com/FasterXML/jackson-databind/issues/2698",
              "refsource": "MISC",
              "url": "https://github.com/FasterXML/jackson-databind/issues/2698"
            },
            {
              "name": "[debian-lts-announce] 20200701 [SECURITY] [DLA 2270-1] jackson-databind security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200702-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200702-0003/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
            },
            {
              "name": "https://www.oracle.com//security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-14061",
    "datePublished": "2020-06-14T19:42:39",
    "dateReserved": "2020-06-14T00:00:00",
    "dateUpdated": "2024-08-04T12:32:14.691Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2020-14195

Vulnerability from cvelistv5

Published

2020-06-16 15:07

Modified

2024-08-04 12:39

Severity ?

Summary

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).

References

▼	URL	Tags
	https://github.com/FasterXML/jackson-databind/issues/2765	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20200702-0003/	x_refsource_CONFIRM
	https://www.oracle.com/security-alerts/cpujan2021.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuApr2021.html	x_refsource_MISC
	https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:39:36.209Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/FasterXML/jackson-databind/issues/2765"
          },
          {
            "name": "[debian-lts-announce] 20200701 [SECURITY] [DLA 2270-1] jackson-databind security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200702-0003/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-20T10:39:13",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/issues/2765"
        },
        {
          "name": "[debian-lts-announce] 20200701 [SECURITY] [DLA 2270-1] jackson-databind security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200702-0003/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-14195",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/FasterXML/jackson-databind/issues/2765",
              "refsource": "MISC",
              "url": "https://github.com/FasterXML/jackson-databind/issues/2765"
            },
            {
              "name": "[debian-lts-announce] 20200701 [SECURITY] [DLA 2270-1] jackson-databind security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200702-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200702-0003/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
            },
            {
              "name": "https://www.oracle.com//security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-14195",
    "datePublished": "2020-06-16T15:07:11",
    "dateReserved": "2020-06-16T00:00:00",
    "dateUpdated": "2024-08-04T12:39:36.209Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2020-8840

Vulnerability from cvelistv5

Published

2020-02-10 19:41

Modified

2024-08-04 10:12

Severity ?

Summary

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

References

▼	URL	Tags
	https://lists.apache.org/thread.html/r078e68a926ea6be12e8404e47f45aabf04bb4668e8265c0de41db6db%40%3Ccommits.druid.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r319f19c74e06c201b9d4e8b282a4e4b2da6dcda022fb46f007dd00d3%40%3Ccommits.druid.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2020/02/msg00020.html	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r3d20a2660b36551fd8257d479941782af4a7169582449fac1704bde2%40%3Ccommits.druid.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rb43f9a65150948a6bebd3cb77ee3e105d40db2820fd547528f4e7f89%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r9ecf211c22760b00967ebe158c6ed7dba9142078e2a630ab8904a5b7%40%3Cdev.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r3539bd3a377991217d724879d239e16e86001c54160076408574e1da%40%3Cnotifications.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r6fdd4c61a09a0c89f581b4ddb3dc6f154ab0c705fcfd0a7358b2e4e5%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/re7326b8655eab931f2a9ce074fd9a1a51b5db11456bee9b48e1e170c%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r428d068b2a4923f1a5a4f5fc6381b95205cfe7620169d16db78e9c71%40%3Cnotifications.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r46bebdeb59b8b7212d63a010ca445a9f5c4e9d64dcf693cab6f399d3%40%3Ccommits.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/re8ae2670ec456ef1c5a2a661a2838ab2cd00e9efa1e88c069f546f21%40%3Ccommits.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r8170007fd9b263d65b37d92a7b5d7bc357aedbb113a32838bc4a9485%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rac5ee5d686818be7e7c430d35108ee01a88aae54f832d32f62431fd1%40%3Cnotifications.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rdf8d389271a291dde3b2f99c36918d6cb1e796958af626cc140fee23%40%3Ccommits.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rb5eedf90ba3633e171a2ffdfe484651c9490dc5df74c8a29244cbc0e%40%3Ccommits.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r65ee95fa09c831843bac81eaa582fdddc2b6119912a72d1c83a9b882%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rb99c7321eba5d4c907beec46675d52827528b738cfafd48eb4d862f1%40%3Cdev.tomee.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rdea588d4a0ebf9cb7ce8c3a8f18d0d306507c4f8ba178dd3d20207b8%40%3Cdev.tomee.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r1c09b9551f6953dbeca190a4c4b78198cdbb9825fce36f96fe3d8218%40%3Cdev.tomee.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rc068e824654c4b8bd4f2490bec869e29edbfcd5dfe02d47cbf7433b2%40%3Cdev.tomee.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rc717fd6c65190f4e592345713f9ef0723fb7d71f624caa2a17caa26a%40%3Cdev.ranger.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rdf311f13e6356297e0ffe74397fdd25a3687b0a16e687c3ff5b834d8%40%3Cdev.ranger.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rf28ab6f224b48452afd567dfffb705fbda0fdbbf6535f6bc69d47e91%40%3Cdev.ranger.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r2fa8046bd47fb407ca09b5107a80fa6147ba4ebe879caae5c98b7657%40%3Cdev.ranger.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r5d8bea8e9d17b6efcf4a0e4e194e91ef46a99f505777a31a60da2b38%40%3Cdev.ranger.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r94930e39b60fff236160c1c4110fe884dc093044b067aa5fc98d7ee1%40%3Cdev.ranger.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r446646c5588b10f5e02409ad580b12f314869009cdfbf844ca395cec%40%3Cdev.ranger.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r1efc776fc6ce3387593deaa94bbdd296733b1b01408a39c8d1ab9e0e%40%3Cdev.ranger.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rfc1ccfe89332155b72ce17f13a2701d3e7b9ec213324ceb90e79a28a%40%3Cdev.ranger.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r9e59ebaf76fd00b2fa3ff5ebf18fe075ca9f4376216612c696f76718%40%3Cdev.ranger.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rcc72b497e3dff2dc62ec9b89ceb90bc4e1b14fc56c3c252a6fcbb013%40%3Cdev.ranger.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r7762d69e85c58d6948823424017ef4c08f47de077644277fa18cc116%40%3Cdev.ranger.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/ra275f29615f35d5b40106d1582a41e5388b2a5131564e9e01a572987%40%3Cdev.ranger.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rb73708bf714ed6dbc1212da082e7703e586077f0c92f3940b2e82caf%40%3Cdev.ranger.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r7e5c10534ed06bf805473ac85e8412fe3908a8fa4cabf5027bf11220%40%3Cdev.kafka.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r8e96c340004b7898cad3204ea51280ef6e4b553a684e1452bf1b18b1%40%3Cjira.kafka.apache.org%3E	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpuapr2020.html	x_refsource_MISC
	https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
	https://github.com/FasterXML/jackson-databind/issues/2620	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20200327-0002/	x_refsource_CONFIRM
	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200610-01-fastjason-en	x_refsource_CONFIRM

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:12:10.909Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[druid-commits] 20200219 [GitHub] [druid] ccaominh opened a new pull request #9379: Suppress CVE-2020-8840 for htrace-core-4.0.1",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r078e68a926ea6be12e8404e47f45aabf04bb4668e8265c0de41db6db%40%3Ccommits.druid.apache.org%3E"
          },
          {
            "name": "[druid-commits] 20200219 [GitHub] [druid] suneet-s commented on issue #9379: Suppress CVE-2020-8840 for htrace-core-4.0.1",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r319f19c74e06c201b9d4e8b282a4e4b2da6dcda022fb46f007dd00d3%40%3Ccommits.druid.apache.org%3E"
          },
          {
            "name": "[debian-lts-announce] 20200220 [SECURITY] [DLA 2111-1] jackson-databind security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00020.html"
          },
          {
            "name": "[druid-commits] 20200221 [GitHub] [druid] ccaominh merged pull request #9379: Suppress CVE-2020-8840 for htrace-core-4.0.1",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r3d20a2660b36551fd8257d479941782af4a7169582449fac1704bde2%40%3Ccommits.druid.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200222 [jira] [Created] (ZOOKEEPER-3734) upgrade jackson-databind to address CVE-2020-8840",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb43f9a65150948a6bebd3cb77ee3e105d40db2820fd547528f4e7f89%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-dev] 20200222 [jira] [Created] (ZOOKEEPER-3734) upgrade jackson-databind to address CVE-2020-8840",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r9ecf211c22760b00967ebe158c6ed7dba9142078e2a630ab8904a5b7%40%3Cdev.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-notifications] 20200223 [GitHub] [zookeeper] eolivelli opened a new pull request #1262: ZOOKEEPER-3734 upgrade jackson-databind to address CVE-2020-8840",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r3539bd3a377991217d724879d239e16e86001c54160076408574e1da%40%3Cnotifications.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200223 [jira] [Updated] (ZOOKEEPER-3734) upgrade jackson-databind to address CVE-2020-8840",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r6fdd4c61a09a0c89f581b4ddb3dc6f154ab0c705fcfd0a7358b2e4e5%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200223 [jira] [Assigned] (ZOOKEEPER-3734) upgrade jackson-databind to address CVE-2020-8840",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/re7326b8655eab931f2a9ce074fd9a1a51b5db11456bee9b48e1e170c%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-notifications] 20200223 [GitHub] [zookeeper] phunt commented on issue #1262: ZOOKEEPER-3734 upgrade jackson-databind to address CVE-2020-8840",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r428d068b2a4923f1a5a4f5fc6381b95205cfe7620169d16db78e9c71%40%3Cnotifications.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-commits] 20200223 [zookeeper] branch master updated: ZOOKEEPER-3734: upgrade jackson-databind to address CVE-2020-8840",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r46bebdeb59b8b7212d63a010ca445a9f5c4e9d64dcf693cab6f399d3%40%3Ccommits.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-commits] 20200223 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3734: upgrade jackson-databind to address CVE-2020-8840",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/re8ae2670ec456ef1c5a2a661a2838ab2cd00e9efa1e88c069f546f21%40%3Ccommits.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200223 [jira] [Resolved] (ZOOKEEPER-3734) upgrade jackson-databind to address CVE-2020-8840",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r8170007fd9b263d65b37d92a7b5d7bc357aedbb113a32838bc4a9485%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-notifications] 20200223 [GitHub] [zookeeper] asfgit closed pull request #1262: ZOOKEEPER-3734 upgrade jackson-databind to address CVE-2020-8840",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rac5ee5d686818be7e7c430d35108ee01a88aae54f832d32f62431fd1%40%3Cnotifications.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-commits] 20200223 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-3734: upgrade jackson-databind to address CVE-2020-8840",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rdf8d389271a291dde3b2f99c36918d6cb1e796958af626cc140fee23%40%3Ccommits.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-commits] 20200224 [zookeeper] 01/02: ZOOKEEPER-3734: upgrade jackson-databind to address CVE-2020-8840",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb5eedf90ba3633e171a2ffdfe484651c9490dc5df74c8a29244cbc0e%40%3Ccommits.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200225 [jira] [Updated] (ZOOKEEPER-3734) upgrade jackson-databind to address CVE-2020-8840",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r65ee95fa09c831843bac81eaa582fdddc2b6119912a72d1c83a9b882%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[tomee-dev] 20200311 CVE-2020-8840 on TomEE 8.0.1",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb99c7321eba5d4c907beec46675d52827528b738cfafd48eb4d862f1%40%3Cdev.tomee.apache.org%3E"
          },
          {
            "name": "[tomee-dev] 20200311 Re: CVE-2020-8840 on TomEE 8.0.1",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rdea588d4a0ebf9cb7ce8c3a8f18d0d306507c4f8ba178dd3d20207b8%40%3Cdev.tomee.apache.org%3E"
          },
          {
            "name": "[tomee-dev] 20200313 Re: CVE-2020-8840 on TomEE 8.0.1",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r1c09b9551f6953dbeca190a4c4b78198cdbb9825fce36f96fe3d8218%40%3Cdev.tomee.apache.org%3E"
          },
          {
            "name": "[tomee-dev] 20200316 RE: CVE-2020-8840 on TomEE 8.0.1",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rc068e824654c4b8bd4f2490bec869e29edbfcd5dfe02d47cbf7433b2%40%3Cdev.tomee.apache.org%3E"
          },
          {
            "name": "[ranger-dev] 20200330 [jira] [Updated] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rc717fd6c65190f4e592345713f9ef0723fb7d71f624caa2a17caa26a%40%3Cdev.ranger.apache.org%3E"
          },
          {
            "name": "[ranger-dev] 20200330 [jira] [Created] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rdf311f13e6356297e0ffe74397fdd25a3687b0a16e687c3ff5b834d8%40%3Cdev.ranger.apache.org%3E"
          },
          {
            "name": "[ranger-dev] 20200408 Re: Review Request 72332: RANGER-2770 : Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf28ab6f224b48452afd567dfffb705fbda0fdbbf6535f6bc69d47e91%40%3Cdev.ranger.apache.org%3E"
          },
          {
            "name": "[ranger-dev] 20200408 Review Request 72332: RANGER-2770 : Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r2fa8046bd47fb407ca09b5107a80fa6147ba4ebe879caae5c98b7657%40%3Cdev.ranger.apache.org%3E"
          },
          {
            "name": "[ranger-dev] 20200415 [jira] [Commented] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r5d8bea8e9d17b6efcf4a0e4e194e91ef46a99f505777a31a60da2b38%40%3Cdev.ranger.apache.org%3E"
          },
          {
            "name": "[ranger-dev] 20200416 [jira] [Updated] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r94930e39b60fff236160c1c4110fe884dc093044b067aa5fc98d7ee1%40%3Cdev.ranger.apache.org%3E"
          },
          {
            "name": "[ranger-dev] 20200416 Re: Review Request 72332: RANGER-2770 : Upgrade jackson-databind to version 2.9.10.4 [CVE-2020-8840] - (Ranger)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r446646c5588b10f5e02409ad580b12f314869009cdfbf844ca395cec%40%3Cdev.ranger.apache.org%3E"
          },
          {
            "name": "[ranger-dev] 20200417 [jira] [Updated] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r1efc776fc6ce3387593deaa94bbdd296733b1b01408a39c8d1ab9e0e%40%3Cdev.ranger.apache.org%3E"
          },
          {
            "name": "[ranger-dev] 20200417 Re: Review Request 72332: RANGER-2770 : Upgrade jackson-databind to version 2.9.10.4 [CVE-2020-8840] - (Ranger)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rfc1ccfe89332155b72ce17f13a2701d3e7b9ec213324ceb90e79a28a%40%3Cdev.ranger.apache.org%3E"
          },
          {
            "name": "[ranger-dev] 20200427 [jira] [Commented] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r9e59ebaf76fd00b2fa3ff5ebf18fe075ca9f4376216612c696f76718%40%3Cdev.ranger.apache.org%3E"
          },
          {
            "name": "[ranger-dev] 20200427 [jira] [Resolved] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rcc72b497e3dff2dc62ec9b89ceb90bc4e1b14fc56c3c252a6fcbb013%40%3Cdev.ranger.apache.org%3E"
          },
          {
            "name": "[ranger-dev] 20200430 Re: Review Request 72332: RANGER-2770 : Upgrade jackson-databind to version 2.9.10.4 [CVE-2020-8840] - (Ranger)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r7762d69e85c58d6948823424017ef4c08f47de077644277fa18cc116%40%3Cdev.ranger.apache.org%3E"
          },
          {
            "name": "[ranger-dev] 20200507 [jira] [Commented] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/ra275f29615f35d5b40106d1582a41e5388b2a5131564e9e01a572987%40%3Cdev.ranger.apache.org%3E"
          },
          {
            "name": "[ranger-dev] 20200514 [jira] [Updated] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb73708bf714ed6dbc1212da082e7703e586077f0c92f3940b2e82caf%40%3Cdev.ranger.apache.org%3E"
          },
          {
            "name": "[kafka-dev] 20200514 [jira] [Created] (KAFKA-9996) upgrade zookeeper to 3.5.8 to address security vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r7e5c10534ed06bf805473ac85e8412fe3908a8fa4cabf5027bf11220%40%3Cdev.kafka.apache.org%3E"
          },
          {
            "name": "[kafka-jira] 20200514 [jira] [Created] (KAFKA-9996) upgrade zookeeper to 3.5.8 to address security vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r8e96c340004b7898cad3204ea51280ef6e4b553a684e1452bf1b18b1%40%3Cjira.kafka.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "name": "[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E"
          },
          {
            "name": "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/FasterXML/jackson-databind/issues/2620"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200327-0002/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200610-01-fastjason-en"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-10-20T21:15:05",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[druid-commits] 20200219 [GitHub] [druid] ccaominh opened a new pull request #9379: Suppress CVE-2020-8840 for htrace-core-4.0.1",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r078e68a926ea6be12e8404e47f45aabf04bb4668e8265c0de41db6db%40%3Ccommits.druid.apache.org%3E"
        },
        {
          "name": "[druid-commits] 20200219 [GitHub] [druid] suneet-s commented on issue #9379: Suppress CVE-2020-8840 for htrace-core-4.0.1",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r319f19c74e06c201b9d4e8b282a4e4b2da6dcda022fb46f007dd00d3%40%3Ccommits.druid.apache.org%3E"
        },
        {
          "name": "[debian-lts-announce] 20200220 [SECURITY] [DLA 2111-1] jackson-databind security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00020.html"
        },
        {
          "name": "[druid-commits] 20200221 [GitHub] [druid] ccaominh merged pull request #9379: Suppress CVE-2020-8840 for htrace-core-4.0.1",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r3d20a2660b36551fd8257d479941782af4a7169582449fac1704bde2%40%3Ccommits.druid.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200222 [jira] [Created] (ZOOKEEPER-3734) upgrade jackson-databind to address CVE-2020-8840",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb43f9a65150948a6bebd3cb77ee3e105d40db2820fd547528f4e7f89%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-dev] 20200222 [jira] [Created] (ZOOKEEPER-3734) upgrade jackson-databind to address CVE-2020-8840",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r9ecf211c22760b00967ebe158c6ed7dba9142078e2a630ab8904a5b7%40%3Cdev.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-notifications] 20200223 [GitHub] [zookeeper] eolivelli opened a new pull request #1262: ZOOKEEPER-3734 upgrade jackson-databind to address CVE-2020-8840",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r3539bd3a377991217d724879d239e16e86001c54160076408574e1da%40%3Cnotifications.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200223 [jira] [Updated] (ZOOKEEPER-3734) upgrade jackson-databind to address CVE-2020-8840",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r6fdd4c61a09a0c89f581b4ddb3dc6f154ab0c705fcfd0a7358b2e4e5%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200223 [jira] [Assigned] (ZOOKEEPER-3734) upgrade jackson-databind to address CVE-2020-8840",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/re7326b8655eab931f2a9ce074fd9a1a51b5db11456bee9b48e1e170c%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-notifications] 20200223 [GitHub] [zookeeper] phunt commented on issue #1262: ZOOKEEPER-3734 upgrade jackson-databind to address CVE-2020-8840",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r428d068b2a4923f1a5a4f5fc6381b95205cfe7620169d16db78e9c71%40%3Cnotifications.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-commits] 20200223 [zookeeper] branch master updated: ZOOKEEPER-3734: upgrade jackson-databind to address CVE-2020-8840",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r46bebdeb59b8b7212d63a010ca445a9f5c4e9d64dcf693cab6f399d3%40%3Ccommits.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-commits] 20200223 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3734: upgrade jackson-databind to address CVE-2020-8840",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/re8ae2670ec456ef1c5a2a661a2838ab2cd00e9efa1e88c069f546f21%40%3Ccommits.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200223 [jira] [Resolved] (ZOOKEEPER-3734) upgrade jackson-databind to address CVE-2020-8840",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r8170007fd9b263d65b37d92a7b5d7bc357aedbb113a32838bc4a9485%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-notifications] 20200223 [GitHub] [zookeeper] asfgit closed pull request #1262: ZOOKEEPER-3734 upgrade jackson-databind to address CVE-2020-8840",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rac5ee5d686818be7e7c430d35108ee01a88aae54f832d32f62431fd1%40%3Cnotifications.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-commits] 20200223 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-3734: upgrade jackson-databind to address CVE-2020-8840",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rdf8d389271a291dde3b2f99c36918d6cb1e796958af626cc140fee23%40%3Ccommits.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-commits] 20200224 [zookeeper] 01/02: ZOOKEEPER-3734: upgrade jackson-databind to address CVE-2020-8840",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb5eedf90ba3633e171a2ffdfe484651c9490dc5df74c8a29244cbc0e%40%3Ccommits.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200225 [jira] [Updated] (ZOOKEEPER-3734) upgrade jackson-databind to address CVE-2020-8840",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r65ee95fa09c831843bac81eaa582fdddc2b6119912a72d1c83a9b882%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[tomee-dev] 20200311 CVE-2020-8840 on TomEE 8.0.1",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb99c7321eba5d4c907beec46675d52827528b738cfafd48eb4d862f1%40%3Cdev.tomee.apache.org%3E"
        },
        {
          "name": "[tomee-dev] 20200311 Re: CVE-2020-8840 on TomEE 8.0.1",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rdea588d4a0ebf9cb7ce8c3a8f18d0d306507c4f8ba178dd3d20207b8%40%3Cdev.tomee.apache.org%3E"
        },
        {
          "name": "[tomee-dev] 20200313 Re: CVE-2020-8840 on TomEE 8.0.1",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r1c09b9551f6953dbeca190a4c4b78198cdbb9825fce36f96fe3d8218%40%3Cdev.tomee.apache.org%3E"
        },
        {
          "name": "[tomee-dev] 20200316 RE: CVE-2020-8840 on TomEE 8.0.1",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rc068e824654c4b8bd4f2490bec869e29edbfcd5dfe02d47cbf7433b2%40%3Cdev.tomee.apache.org%3E"
        },
        {
          "name": "[ranger-dev] 20200330 [jira] [Updated] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rc717fd6c65190f4e592345713f9ef0723fb7d71f624caa2a17caa26a%40%3Cdev.ranger.apache.org%3E"
        },
        {
          "name": "[ranger-dev] 20200330 [jira] [Created] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rdf311f13e6356297e0ffe74397fdd25a3687b0a16e687c3ff5b834d8%40%3Cdev.ranger.apache.org%3E"
        },
        {
          "name": "[ranger-dev] 20200408 Re: Review Request 72332: RANGER-2770 : Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf28ab6f224b48452afd567dfffb705fbda0fdbbf6535f6bc69d47e91%40%3Cdev.ranger.apache.org%3E"
        },
        {
          "name": "[ranger-dev] 20200408 Review Request 72332: RANGER-2770 : Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r2fa8046bd47fb407ca09b5107a80fa6147ba4ebe879caae5c98b7657%40%3Cdev.ranger.apache.org%3E"
        },
        {
          "name": "[ranger-dev] 20200415 [jira] [Commented] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r5d8bea8e9d17b6efcf4a0e4e194e91ef46a99f505777a31a60da2b38%40%3Cdev.ranger.apache.org%3E"
        },
        {
          "name": "[ranger-dev] 20200416 [jira] [Updated] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r94930e39b60fff236160c1c4110fe884dc093044b067aa5fc98d7ee1%40%3Cdev.ranger.apache.org%3E"
        },
        {
          "name": "[ranger-dev] 20200416 Re: Review Request 72332: RANGER-2770 : Upgrade jackson-databind to version 2.9.10.4 [CVE-2020-8840] - (Ranger)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r446646c5588b10f5e02409ad580b12f314869009cdfbf844ca395cec%40%3Cdev.ranger.apache.org%3E"
        },
        {
          "name": "[ranger-dev] 20200417 [jira] [Updated] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r1efc776fc6ce3387593deaa94bbdd296733b1b01408a39c8d1ab9e0e%40%3Cdev.ranger.apache.org%3E"
        },
        {
          "name": "[ranger-dev] 20200417 Re: Review Request 72332: RANGER-2770 : Upgrade jackson-databind to version 2.9.10.4 [CVE-2020-8840] - (Ranger)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rfc1ccfe89332155b72ce17f13a2701d3e7b9ec213324ceb90e79a28a%40%3Cdev.ranger.apache.org%3E"
        },
        {
          "name": "[ranger-dev] 20200427 [jira] [Commented] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r9e59ebaf76fd00b2fa3ff5ebf18fe075ca9f4376216612c696f76718%40%3Cdev.ranger.apache.org%3E"
        },
        {
          "name": "[ranger-dev] 20200427 [jira] [Resolved] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rcc72b497e3dff2dc62ec9b89ceb90bc4e1b14fc56c3c252a6fcbb013%40%3Cdev.ranger.apache.org%3E"
        },
        {
          "name": "[ranger-dev] 20200430 Re: Review Request 72332: RANGER-2770 : Upgrade jackson-databind to version 2.9.10.4 [CVE-2020-8840] - (Ranger)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r7762d69e85c58d6948823424017ef4c08f47de077644277fa18cc116%40%3Cdev.ranger.apache.org%3E"
        },
        {
          "name": "[ranger-dev] 20200507 [jira] [Commented] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/ra275f29615f35d5b40106d1582a41e5388b2a5131564e9e01a572987%40%3Cdev.ranger.apache.org%3E"
        },
        {
          "name": "[ranger-dev] 20200514 [jira] [Updated] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb73708bf714ed6dbc1212da082e7703e586077f0c92f3940b2e82caf%40%3Cdev.ranger.apache.org%3E"
        },
        {
          "name": "[kafka-dev] 20200514 [jira] [Created] (KAFKA-9996) upgrade zookeeper to 3.5.8 to address security vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r7e5c10534ed06bf805473ac85e8412fe3908a8fa4cabf5027bf11220%40%3Cdev.kafka.apache.org%3E"
        },
        {
          "name": "[kafka-jira] 20200514 [jira] [Created] (KAFKA-9996) upgrade zookeeper to 3.5.8 to address security vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r8e96c340004b7898cad3204ea51280ef6e4b553a684e1452bf1b18b1%40%3Cjira.kafka.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        },
        {
          "name": "[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E"
        },
        {
          "name": "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/issues/2620"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200327-0002/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200610-01-fastjason-en"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-8840",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[druid-commits] 20200219 [GitHub] [druid] ccaominh opened a new pull request #9379: Suppress CVE-2020-8840 for htrace-core-4.0.1",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r078e68a926ea6be12e8404e47f45aabf04bb4668e8265c0de41db6db@%3Ccommits.druid.apache.org%3E"
            },
            {
              "name": "[druid-commits] 20200219 [GitHub] [druid] suneet-s commented on issue #9379: Suppress CVE-2020-8840 for htrace-core-4.0.1",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r319f19c74e06c201b9d4e8b282a4e4b2da6dcda022fb46f007dd00d3@%3Ccommits.druid.apache.org%3E"
            },
            {
              "name": "[debian-lts-announce] 20200220 [SECURITY] [DLA 2111-1] jackson-databind security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00020.html"
            },
            {
              "name": "[druid-commits] 20200221 [GitHub] [druid] ccaominh merged pull request #9379: Suppress CVE-2020-8840 for htrace-core-4.0.1",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r3d20a2660b36551fd8257d479941782af4a7169582449fac1704bde2@%3Ccommits.druid.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200222 [jira] [Created] (ZOOKEEPER-3734) upgrade jackson-databind to address CVE-2020-8840",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb43f9a65150948a6bebd3cb77ee3e105d40db2820fd547528f4e7f89@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-dev] 20200222 [jira] [Created] (ZOOKEEPER-3734) upgrade jackson-databind to address CVE-2020-8840",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r9ecf211c22760b00967ebe158c6ed7dba9142078e2a630ab8904a5b7@%3Cdev.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-notifications] 20200223 [GitHub] [zookeeper] eolivelli opened a new pull request #1262: ZOOKEEPER-3734 upgrade jackson-databind to address CVE-2020-8840",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r3539bd3a377991217d724879d239e16e86001c54160076408574e1da@%3Cnotifications.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200223 [jira] [Updated] (ZOOKEEPER-3734) upgrade jackson-databind to address CVE-2020-8840",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r6fdd4c61a09a0c89f581b4ddb3dc6f154ab0c705fcfd0a7358b2e4e5@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200223 [jira] [Assigned] (ZOOKEEPER-3734) upgrade jackson-databind to address CVE-2020-8840",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/re7326b8655eab931f2a9ce074fd9a1a51b5db11456bee9b48e1e170c@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-notifications] 20200223 [GitHub] [zookeeper] phunt commented on issue #1262: ZOOKEEPER-3734 upgrade jackson-databind to address CVE-2020-8840",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r428d068b2a4923f1a5a4f5fc6381b95205cfe7620169d16db78e9c71@%3Cnotifications.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-commits] 20200223 [zookeeper] branch master updated: ZOOKEEPER-3734: upgrade jackson-databind to address CVE-2020-8840",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r46bebdeb59b8b7212d63a010ca445a9f5c4e9d64dcf693cab6f399d3@%3Ccommits.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-commits] 20200223 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3734: upgrade jackson-databind to address CVE-2020-8840",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/re8ae2670ec456ef1c5a2a661a2838ab2cd00e9efa1e88c069f546f21@%3Ccommits.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200223 [jira] [Resolved] (ZOOKEEPER-3734) upgrade jackson-databind to address CVE-2020-8840",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r8170007fd9b263d65b37d92a7b5d7bc357aedbb113a32838bc4a9485@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-notifications] 20200223 [GitHub] [zookeeper] asfgit closed pull request #1262: ZOOKEEPER-3734 upgrade jackson-databind to address CVE-2020-8840",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rac5ee5d686818be7e7c430d35108ee01a88aae54f832d32f62431fd1@%3Cnotifications.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-commits] 20200223 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-3734: upgrade jackson-databind to address CVE-2020-8840",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rdf8d389271a291dde3b2f99c36918d6cb1e796958af626cc140fee23@%3Ccommits.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-commits] 20200224 [zookeeper] 01/02: ZOOKEEPER-3734: upgrade jackson-databind to address CVE-2020-8840",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb5eedf90ba3633e171a2ffdfe484651c9490dc5df74c8a29244cbc0e@%3Ccommits.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200225 [jira] [Updated] (ZOOKEEPER-3734) upgrade jackson-databind to address CVE-2020-8840",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r65ee95fa09c831843bac81eaa582fdddc2b6119912a72d1c83a9b882@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[tomee-dev] 20200311 CVE-2020-8840 on TomEE 8.0.1",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb99c7321eba5d4c907beec46675d52827528b738cfafd48eb4d862f1@%3Cdev.tomee.apache.org%3E"
            },
            {
              "name": "[tomee-dev] 20200311 Re: CVE-2020-8840 on TomEE 8.0.1",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rdea588d4a0ebf9cb7ce8c3a8f18d0d306507c4f8ba178dd3d20207b8@%3Cdev.tomee.apache.org%3E"
            },
            {
              "name": "[tomee-dev] 20200313 Re: CVE-2020-8840 on TomEE 8.0.1",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r1c09b9551f6953dbeca190a4c4b78198cdbb9825fce36f96fe3d8218@%3Cdev.tomee.apache.org%3E"
            },
            {
              "name": "[tomee-dev] 20200316 RE: CVE-2020-8840 on TomEE 8.0.1",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rc068e824654c4b8bd4f2490bec869e29edbfcd5dfe02d47cbf7433b2@%3Cdev.tomee.apache.org%3E"
            },
            {
              "name": "[ranger-dev] 20200330 [jira] [Updated] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rc717fd6c65190f4e592345713f9ef0723fb7d71f624caa2a17caa26a@%3Cdev.ranger.apache.org%3E"
            },
            {
              "name": "[ranger-dev] 20200330 [jira] [Created] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rdf311f13e6356297e0ffe74397fdd25a3687b0a16e687c3ff5b834d8@%3Cdev.ranger.apache.org%3E"
            },
            {
              "name": "[ranger-dev] 20200408 Re: Review Request 72332: RANGER-2770 : Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf28ab6f224b48452afd567dfffb705fbda0fdbbf6535f6bc69d47e91@%3Cdev.ranger.apache.org%3E"
            },
            {
              "name": "[ranger-dev] 20200408 Review Request 72332: RANGER-2770 : Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r2fa8046bd47fb407ca09b5107a80fa6147ba4ebe879caae5c98b7657@%3Cdev.ranger.apache.org%3E"
            },
            {
              "name": "[ranger-dev] 20200415 [jira] [Commented] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r5d8bea8e9d17b6efcf4a0e4e194e91ef46a99f505777a31a60da2b38@%3Cdev.ranger.apache.org%3E"
            },
            {
              "name": "[ranger-dev] 20200416 [jira] [Updated] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r94930e39b60fff236160c1c4110fe884dc093044b067aa5fc98d7ee1@%3Cdev.ranger.apache.org%3E"
            },
            {
              "name": "[ranger-dev] 20200416 Re: Review Request 72332: RANGER-2770 : Upgrade jackson-databind to version 2.9.10.4 [CVE-2020-8840] - (Ranger)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r446646c5588b10f5e02409ad580b12f314869009cdfbf844ca395cec@%3Cdev.ranger.apache.org%3E"
            },
            {
              "name": "[ranger-dev] 20200417 [jira] [Updated] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r1efc776fc6ce3387593deaa94bbdd296733b1b01408a39c8d1ab9e0e@%3Cdev.ranger.apache.org%3E"
            },
            {
              "name": "[ranger-dev] 20200417 Re: Review Request 72332: RANGER-2770 : Upgrade jackson-databind to version 2.9.10.4 [CVE-2020-8840] - (Ranger)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rfc1ccfe89332155b72ce17f13a2701d3e7b9ec213324ceb90e79a28a@%3Cdev.ranger.apache.org%3E"
            },
            {
              "name": "[ranger-dev] 20200427 [jira] [Commented] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r9e59ebaf76fd00b2fa3ff5ebf18fe075ca9f4376216612c696f76718@%3Cdev.ranger.apache.org%3E"
            },
            {
              "name": "[ranger-dev] 20200427 [jira] [Resolved] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rcc72b497e3dff2dc62ec9b89ceb90bc4e1b14fc56c3c252a6fcbb013@%3Cdev.ranger.apache.org%3E"
            },
            {
              "name": "[ranger-dev] 20200430 Re: Review Request 72332: RANGER-2770 : Upgrade jackson-databind to version 2.9.10.4 [CVE-2020-8840] - (Ranger)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r7762d69e85c58d6948823424017ef4c08f47de077644277fa18cc116@%3Cdev.ranger.apache.org%3E"
            },
            {
              "name": "[ranger-dev] 20200507 [jira] [Commented] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/ra275f29615f35d5b40106d1582a41e5388b2a5131564e9e01a572987@%3Cdev.ranger.apache.org%3E"
            },
            {
              "name": "[ranger-dev] 20200514 [jira] [Updated] (RANGER-2770) Upgrade jackson-databind to version 2.10.0 [CVE-2020-8840] - (Ranger)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb73708bf714ed6dbc1212da082e7703e586077f0c92f3940b2e82caf@%3Cdev.ranger.apache.org%3E"
            },
            {
              "name": "[kafka-dev] 20200514 [jira] [Created] (KAFKA-9996) upgrade zookeeper to 3.5.8 to address security vulnerabilities",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r7e5c10534ed06bf805473ac85e8412fe3908a8fa4cabf5027bf11220@%3Cdev.kafka.apache.org%3E"
            },
            {
              "name": "[kafka-jira] 20200514 [jira] [Created] (KAFKA-9996) upgrade zookeeper to 3.5.8 to address security vulnerabilities",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r8e96c340004b7898cad3204ea51280ef6e4b553a684e1452bf1b18b1@%3Cjira.kafka.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
            },
            {
              "name": "[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E"
            },
            {
              "name": "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://github.com/FasterXML/jackson-databind/issues/2620",
              "refsource": "MISC",
              "url": "https://github.com/FasterXML/jackson-databind/issues/2620"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200327-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200327-0002/"
            },
            {
              "name": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200610-01-fastjason-en",
              "refsource": "CONFIRM",
              "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200610-01-fastjason-en"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-8840",
    "datePublished": "2020-02-10T19:41:58",
    "dateReserved": "2020-02-10T00:00:00",
    "dateUpdated": "2024-08-04T10:12:10.909Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2020-11619

Vulnerability from cvelistv5

Published

2020-04-07 22:14

Modified

2024-08-04 11:35

Severity ?

Summary

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).

References

▼	URL	Tags
	https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html	mailing-list, x_refsource_MLIST
	https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://github.com/FasterXML/jackson-databind/issues/2680	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20200511-0004/	x_refsource_CONFIRM
	https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujan2021.html	x_refsource_MISC

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:35:13.200Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[debian-lts-announce] 20200417 [SECURITY] [DLA 2179-1] jackson-databind security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/FasterXML/jackson-databind/issues/2680"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200511-0004/"
          },
          {
            "name": "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-20T14:42:04",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[debian-lts-announce] 20200417 [SECURITY] [DLA 2179-1] jackson-databind security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/issues/2680"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200511-0004/"
        },
        {
          "name": "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-11619",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[debian-lts-announce] 20200417 [SECURITY] [DLA 2179-1] jackson-databind security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html"
            },
            {
              "name": "https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062",
              "refsource": "MISC",
              "url": "https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
            },
            {
              "name": "https://github.com/FasterXML/jackson-databind/issues/2680",
              "refsource": "MISC",
              "url": "https://github.com/FasterXML/jackson-databind/issues/2680"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200511-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200511-0004/"
            },
            {
              "name": "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-11619",
    "datePublished": "2020-04-07T22:14:09",
    "dateReserved": "2020-04-07T00:00:00",
    "dateUpdated": "2024-08-04T11:35:13.200Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2020-10969

Vulnerability from cvelistv5

Published

2020-03-26 12:43

Modified

2024-08-04 11:21

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.

References

▼	URL	Tags
	https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html	mailing-list, x_refsource_MLIST
	https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20200403-0002/	x_refsource_CONFIRM
	https://github.com/FasterXML/jackson-databind/issues/2642	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujan2021.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "debian_linux",
            "vendor": "debian",
            "versions": [
              {
                "status": "affected",
                "version": "8.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "steelstore_cloud_integrated_storage",
            "vendor": "netapp",
            "versions": [
              {
                "status": "affected",
                "version": "*"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "agile_plm",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "9.3.6"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "autovue_for_agile_product_lifecycle_management",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "21.0.2"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "banking_digital_experience",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "18.3",
                "status": "affected",
                "version": "18.1",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "19.2",
                "status": "affected",
                "version": "19.1",
                "versionType": "custom"
              },
              {
                "status": "affected",
                "version": "20.1"
              },
              {
                "lessThanOrEqual": "2.9.0",
                "status": "affected",
                "version": "2.4.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:communications_calendar_server:8.0.0.4.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "communications_calendar_server",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "8.0.0.5.0",
                "status": "affected",
                "version": "8.0.0.4.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:communications_diameter_signaling_router:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "communications_diameter_signaling_router",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "8.2.2",
                "status": "affected",
                "version": "8.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "communications_element_manager",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "8.2.2",
                "status": "affected",
                "version": "8.2.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "communications_evolved_communications_application_server",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "7.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.4.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "communications_instant_messaging_server",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "10.0.1.4.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "communications_network_charging_and_control",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "6.0.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:communications_network_charging_and_control:12.0.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "communications_network_charging_and_control",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "12.0.3",
                "status": "affected",
                "version": "12.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:communications_session_route_manager:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "communications_session_route_manager",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "8.2.2",
                "status": "affected",
                "version": "8.2.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "enterprise_manager_base_platform",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "13.4.0.0",
                "status": "affected",
                "version": "13.3.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.6:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "financial_services_analytical_applications_infrastructure",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "8.1.0",
                "status": "affected",
                "version": "8.0.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.6:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "financial_services_institutional_performance_analytics",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "8.0.6"
              },
              {
                "status": "affected",
                "version": "8.0.7"
              },
              {
                "status": "affected",
                "version": "8.1.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.6:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "financial_services_price_creation_and_discovery",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "8.0.7",
                "status": "affected",
                "version": "8.0.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:financial_services_retail_customer_analytics:8.0.6:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "financial_services_retail_customer_analytics",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "8.0.6"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "global_lifecycle_management_opatch",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "12.2.0.1.20",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:insurance_policy_administration_j2ee:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "insurance_policy_administration_j2ee",
            "vendor": "oracle",
            "versions": [
              {
                "lessThan": "11.1.0.15",
                "status": "affected",
                "version": "11.0.2.25",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jd_edwards_enterpriseone_orchestrator",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "9.2.4.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "primavera_unifier",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "16.1"
              },
              {
                "status": "affected",
                "version": "16.2"
              },
              {
                "lessThanOrEqual": "17.12",
                "status": "affected",
                "version": "17.7",
                "versionType": "custom"
              },
              {
                "status": "affected",
                "version": "18.8"
              },
              {
                "status": "affected",
                "version": "19.12"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:retail_merchandising_system:15.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "retail_merchandising_system",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "15.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:retail_sales_audit:14.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "retail_sales_audit",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "14.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:retail_service_backbone:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "retail_service_backbone",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "14.1"
              },
              {
                "status": "affected",
                "version": "15.0"
              },
              {
                "status": "affected",
                "version": "16.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "retail_xstore_point_of_service",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "19.0",
                "status": "affected",
                "version": "15.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:weblogic_server:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "weblogic_server",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "12.2.1.4.0",
                "status": "affected",
                "version": "12.2.1.3.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:fasterxml:jackson-databind:2.0.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jackson-databind",
            "vendor": "fasterxml",
            "versions": [
              {
                "lessThan": "2.9.10.4",
                "status": "affected",
                "version": "2.0.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2020-10969",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-25T04:00:45.779442Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-502",
                "description": "CWE-502 Deserialization of Untrusted Data",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T19:58:54.159Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:21:13.816Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[debian-lts-announce] 20200417 [SECURITY] [DLA 2179-1] jackson-databind security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200403-0002/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/FasterXML/jackson-databind/issues/2642"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-20T10:38:44",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[debian-lts-announce] 20200417 [SECURITY] [DLA 2179-1] jackson-databind security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200403-0002/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/issues/2642"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-10969",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[debian-lts-announce] 20200417 [SECURITY] [DLA 2179-1] jackson-databind security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html"
            },
            {
              "name": "https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062",
              "refsource": "MISC",
              "url": "https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200403-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200403-0002/"
            },
            {
              "name": "https://github.com/FasterXML/jackson-databind/issues/2642",
              "refsource": "MISC",
              "url": "https://github.com/FasterXML/jackson-databind/issues/2642"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-10969",
    "datePublished": "2020-03-26T12:43:34",
    "dateReserved": "2020-03-26T00:00:00",
    "dateUpdated": "2024-08-04T11:21:13.816Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2020-14060

Vulnerability from cvelistv5

Published

2020-06-14 20:46

Modified

2024-08-04 12:32

Severity ?

Summary

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).

References

▼	URL	Tags
	https://github.com/FasterXML/jackson-databind/issues/2688	x_refsource_MISC
	https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20200702-0003/	x_refsource_CONFIRM
	https://www.oracle.com/security-alerts/cpujan2021.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuApr2021.html	x_refsource_MISC
	https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:32:14.684Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/FasterXML/jackson-databind/issues/2688"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
          },
          {
            "name": "[debian-lts-announce] 20200701 [SECURITY] [DLA 2270-1] jackson-databind security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200702-0003/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-20T10:39:07",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/issues/2688"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
        },
        {
          "name": "[debian-lts-announce] 20200701 [SECURITY] [DLA 2270-1] jackson-databind security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200702-0003/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-14060",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/FasterXML/jackson-databind/issues/2688",
              "refsource": "MISC",
              "url": "https://github.com/FasterXML/jackson-databind/issues/2688"
            },
            {
              "name": "https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062",
              "refsource": "MISC",
              "url": "https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
            },
            {
              "name": "[debian-lts-announce] 20200701 [SECURITY] [DLA 2270-1] jackson-databind security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200702-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200702-0003/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
            },
            {
              "name": "https://www.oracle.com//security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-14060",
    "datePublished": "2020-06-14T20:46:47",
    "dateReserved": "2020-06-14T00:00:00",
    "dateUpdated": "2024-08-04T12:32:14.684Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2020-14062

Vulnerability from cvelistv5

Published

2020-06-14 19:42

Modified

2024-08-04 12:32

Severity ?

Summary

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2).

References

▼	URL	Tags
	https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062	x_refsource_MISC
	https://github.com/FasterXML/jackson-databind/issues/2704	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20200702-0003/	x_refsource_CONFIRM
	https://www.oracle.com/security-alerts/cpujan2021.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuApr2021.html	x_refsource_MISC
	https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:32:14.668Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/FasterXML/jackson-databind/issues/2704"
          },
          {
            "name": "[debian-lts-announce] 20200701 [SECURITY] [DLA 2270-1] jackson-databind security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200702-0003/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-20T10:39:11",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/issues/2704"
        },
        {
          "name": "[debian-lts-announce] 20200701 [SECURITY] [DLA 2270-1] jackson-databind security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200702-0003/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-14062",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062",
              "refsource": "MISC",
              "url": "https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
            },
            {
              "name": "https://github.com/FasterXML/jackson-databind/issues/2704",
              "refsource": "MISC",
              "url": "https://github.com/FasterXML/jackson-databind/issues/2704"
            },
            {
              "name": "[debian-lts-announce] 20200701 [SECURITY] [DLA 2270-1] jackson-databind security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200702-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200702-0003/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
            },
            {
              "name": "https://www.oracle.com//security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-14062",
    "datePublished": "2020-06-14T19:42:22",
    "dateReserved": "2020-06-14T00:00:00",
    "dateUpdated": "2024-08-04T12:32:14.668Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2020-9547

Vulnerability from cvelistv5

Published

2020-03-02 03:59

Modified

2024-08-04 10:34

Severity ?

Summary

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

References

▼	URL	Tags
	https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rd0e958d6d5c5ee16efed73314cd0e445c8dbb4bdcc80fc9d1d6c11fc%40%3Cdev.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://lists.apache.org/thread.html/r893a0104e50c1c2559eb9a5812add28ae8c3e5f43712947a9847ec18%40%3Cnotifications.zookeeper.apache.org%3E	x_refsource_MISC
	https://github.com/FasterXML/jackson-databind/issues/2634	x_refsource_MISC
	https://lists.apache.org/thread.html/redbe4f1e21bf080f637cf9fbec47729750a2f443a919765360337428%40%3Cnotifications.zookeeper.apache.org%3E	x_refsource_MISC
	https://lists.apache.org/thread.html/r742ef70d126548dcf7de5be5779355c9d76a9aec71d7a9ef02c6398a%40%3Cnotifications.zookeeper.apache.org%3E	x_refsource_MISC
	https://lists.apache.org/thread.html/ra3e90712f2d59f8cef03fa796f5adf163d32b81fe7b95385f21790e6%40%3Cnotifications.zookeeper.apache.org%3E	x_refsource_MISC
	https://lists.apache.org/thread.html/r4accb2e0de9679174efd3d113a059bab71ff3ec53e882790d21c1cc1%40%3Cnotifications.zookeeper.apache.org%3E	x_refsource_MISC
	https://lists.apache.org/thread.html/rc0d5d0f72da1ed6fc5e438b1ddb3fa090c73006b55f873cf845375ab%40%3Cnotifications.zookeeper.apache.org%3E	x_refsource_MISC
	https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20200904-0006/	x_refsource_CONFIRM
	https://www.oracle.com/security-alerts/cpujan2021.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:34:39.951Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[debian-lts-announce] 20200305 [SECURITY] [DLA 2135-1] jackson-databind security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html"
          },
          {
            "name": "[zookeeper-issues] 20200307 [jira] [Created] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-dev] 20200307 [jira] [Created] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200307 [jira] [Updated] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-dev] 20200307 Build failed in Jenkins: PreCommit-ZOOKEEPER-github-pr-build-maven #1898",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rd0e958d6d5c5ee16efed73314cd0e445c8dbb4bdcc80fc9d1d6c11fc%40%3Cdev.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200308 [jira] [Commented] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200319 [jira] [Commented] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200319 [jira] [Updated] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200430 [jira] [Resolved] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r893a0104e50c1c2559eb9a5812add28ae8c3e5f43712947a9847ec18%40%3Cnotifications.zookeeper.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/FasterXML/jackson-databind/issues/2634"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/redbe4f1e21bf080f637cf9fbec47729750a2f443a919765360337428%40%3Cnotifications.zookeeper.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r742ef70d126548dcf7de5be5779355c9d76a9aec71d7a9ef02c6398a%40%3Cnotifications.zookeeper.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/ra3e90712f2d59f8cef03fa796f5adf163d32b81fe7b95385f21790e6%40%3Cnotifications.zookeeper.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r4accb2e0de9679174efd3d113a059bab71ff3ec53e882790d21c1cc1%40%3Cnotifications.zookeeper.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rc0d5d0f72da1ed6fc5e438b1ddb3fa090c73006b55f873cf845375ab%40%3Cnotifications.zookeeper.apache.org%3E"
          },
          {
            "name": "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200904-0006/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-20T10:40:29",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[debian-lts-announce] 20200305 [SECURITY] [DLA 2135-1] jackson-databind security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html"
        },
        {
          "name": "[zookeeper-issues] 20200307 [jira] [Created] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-dev] 20200307 [jira] [Created] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200307 [jira] [Updated] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-dev] 20200307 Build failed in Jenkins: PreCommit-ZOOKEEPER-github-pr-build-maven #1898",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rd0e958d6d5c5ee16efed73314cd0e445c8dbb4bdcc80fc9d1d6c11fc%40%3Cdev.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200308 [jira] [Commented] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200319 [jira] [Commented] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200319 [jira] [Updated] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200430 [jira] [Resolved] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread.html/r893a0104e50c1c2559eb9a5812add28ae8c3e5f43712947a9847ec18%40%3Cnotifications.zookeeper.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/issues/2634"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread.html/redbe4f1e21bf080f637cf9fbec47729750a2f443a919765360337428%40%3Cnotifications.zookeeper.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread.html/r742ef70d126548dcf7de5be5779355c9d76a9aec71d7a9ef02c6398a%40%3Cnotifications.zookeeper.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread.html/ra3e90712f2d59f8cef03fa796f5adf163d32b81fe7b95385f21790e6%40%3Cnotifications.zookeeper.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread.html/r4accb2e0de9679174efd3d113a059bab71ff3ec53e882790d21c1cc1%40%3Cnotifications.zookeeper.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread.html/rc0d5d0f72da1ed6fc5e438b1ddb3fa090c73006b55f873cf845375ab%40%3Cnotifications.zookeeper.apache.org%3E"
        },
        {
          "name": "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200904-0006/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-9547",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[debian-lts-announce] 20200305 [SECURITY] [DLA 2135-1] jackson-databind security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html"
            },
            {
              "name": "[zookeeper-issues] 20200307 [jira] [Created] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-dev] 20200307 [jira] [Created] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1@%3Cdev.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200307 [jira] [Updated] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-dev] 20200307 Build failed in Jenkins: PreCommit-ZOOKEEPER-github-pr-build-maven #1898",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rd0e958d6d5c5ee16efed73314cd0e445c8dbb4bdcc80fc9d1d6c11fc@%3Cdev.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200308 [jira] [Commented] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200319 [jira] [Commented] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200319 [jira] [Updated] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200430 [jira] [Resolved] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062",
              "refsource": "MISC",
              "url": "https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
            },
            {
              "name": "https://lists.apache.org/thread.html/r893a0104e50c1c2559eb9a5812add28ae8c3e5f43712947a9847ec18@%3Cnotifications.zookeeper.apache.org%3E",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread.html/r893a0104e50c1c2559eb9a5812add28ae8c3e5f43712947a9847ec18@%3Cnotifications.zookeeper.apache.org%3E"
            },
            {
              "name": "https://github.com/FasterXML/jackson-databind/issues/2634",
              "refsource": "MISC",
              "url": "https://github.com/FasterXML/jackson-databind/issues/2634"
            },
            {
              "name": "https://lists.apache.org/thread.html/redbe4f1e21bf080f637cf9fbec47729750a2f443a919765360337428@%3Cnotifications.zookeeper.apache.org%3E",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread.html/redbe4f1e21bf080f637cf9fbec47729750a2f443a919765360337428@%3Cnotifications.zookeeper.apache.org%3E"
            },
            {
              "name": "https://lists.apache.org/thread.html/r742ef70d126548dcf7de5be5779355c9d76a9aec71d7a9ef02c6398a@%3Cnotifications.zookeeper.apache.org%3E",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread.html/r742ef70d126548dcf7de5be5779355c9d76a9aec71d7a9ef02c6398a@%3Cnotifications.zookeeper.apache.org%3E"
            },
            {
              "name": "https://lists.apache.org/thread.html/ra3e90712f2d59f8cef03fa796f5adf163d32b81fe7b95385f21790e6@%3Cnotifications.zookeeper.apache.org%3E",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread.html/ra3e90712f2d59f8cef03fa796f5adf163d32b81fe7b95385f21790e6@%3Cnotifications.zookeeper.apache.org%3E"
            },
            {
              "name": "https://lists.apache.org/thread.html/r4accb2e0de9679174efd3d113a059bab71ff3ec53e882790d21c1cc1@%3Cnotifications.zookeeper.apache.org%3E",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread.html/r4accb2e0de9679174efd3d113a059bab71ff3ec53e882790d21c1cc1@%3Cnotifications.zookeeper.apache.org%3E"
            },
            {
              "name": "https://lists.apache.org/thread.html/rc0d5d0f72da1ed6fc5e438b1ddb3fa090c73006b55f873cf845375ab@%3Cnotifications.zookeeper.apache.org%3E",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread.html/rc0d5d0f72da1ed6fc5e438b1ddb3fa090c73006b55f873cf845375ab@%3Cnotifications.zookeeper.apache.org%3E"
            },
            {
              "name": "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200904-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200904-0006/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-9547",
    "datePublished": "2020-03-02T03:59:08",
    "dateReserved": "2020-03-02T00:00:00",
    "dateUpdated": "2024-08-04T10:34:39.951Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2020-9548

Vulnerability from cvelistv5

Published

2020-03-02 03:58

Modified

2024-08-04 10:34

Severity ?

Summary

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

References

▼	URL	Tags
	https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://github.com/FasterXML/jackson-databind/issues/2634	x_refsource_MISC
	https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20200904-0006/	x_refsource_CONFIRM
	https://www.oracle.com/security-alerts/cpujan2021.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:34:39.821Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[debian-lts-announce] 20200305 [SECURITY] [DLA 2135-1] jackson-databind security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html"
          },
          {
            "name": "[zookeeper-issues] 20200307 [jira] [Created] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-dev] 20200307 [jira] [Created] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200307 [jira] [Updated] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200308 [jira] [Commented] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200319 [jira] [Commented] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200319 [jira] [Updated] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200430 [jira] [Resolved] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/FasterXML/jackson-databind/issues/2634"
          },
          {
            "name": "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200904-0006/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-20T10:40:31",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[debian-lts-announce] 20200305 [SECURITY] [DLA 2135-1] jackson-databind security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html"
        },
        {
          "name": "[zookeeper-issues] 20200307 [jira] [Created] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-dev] 20200307 [jira] [Created] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200307 [jira] [Updated] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200308 [jira] [Commented] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200319 [jira] [Commented] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200319 [jira] [Updated] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200430 [jira] [Resolved] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/issues/2634"
        },
        {
          "name": "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200904-0006/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-9548",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[debian-lts-announce] 20200305 [SECURITY] [DLA 2135-1] jackson-databind security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html"
            },
            {
              "name": "[zookeeper-issues] 20200307 [jira] [Created] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-dev] 20200307 [jira] [Created] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1@%3Cdev.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200307 [jira] [Updated] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200308 [jira] [Commented] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200319 [jira] [Commented] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200319 [jira] [Updated] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200430 [jira] [Resolved] (ZOOKEEPER-3750) update jackson-databind to address CVE-2020-9547, CVE-2020-9548, CVE-2020-9546",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062",
              "refsource": "MISC",
              "url": "https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
            },
            {
              "name": "https://github.com/FasterXML/jackson-databind/issues/2634",
              "refsource": "MISC",
              "url": "https://github.com/FasterXML/jackson-databind/issues/2634"
            },
            {
              "name": "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200904-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200904-0006/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-9548",
    "datePublished": "2020-03-02T03:58:55",
    "dateReserved": "2020-03-02T00:00:00",
    "dateUpdated": "2024-08-04T10:34:39.821Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2020-10968

Vulnerability from cvelistv5

Published

2020-03-26 12:43

Modified

2024-08-04 11:21

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).

References

▼	URL	Tags
	https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html	mailing-list, x_refsource_MLIST
	https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20200403-0002/	x_refsource_CONFIRM
	https://github.com/FasterXML/jackson-databind/issues/2662	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujan2021.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "debian_linux",
            "vendor": "debian",
            "versions": [
              {
                "status": "affected",
                "version": "8.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "steelstore_cloud_integrated_storage",
            "vendor": "netapp",
            "versions": [
              {
                "status": "affected",
                "version": "*"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "agile_plm",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "9.3.6"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "autovue_for_agile_product_lifecycle_management",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "21.0.2"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "banking_digital_experience",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "18.3",
                "status": "affected",
                "version": "18.1",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "19.2",
                "status": "affected",
                "version": "19.1",
                "versionType": "custom"
              },
              {
                "status": "affected",
                "version": "20.1"
              },
              {
                "lessThanOrEqual": "2.9.0",
                "status": "affected",
                "version": "2.4.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:communications_calendar_server:8.0.0.4.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "communications_calendar_server",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "8.0.0.5.0",
                "status": "affected",
                "version": "8.0.0.4.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:communications_diameter_signaling_router:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "communications_diameter_signaling_router",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "8.2.2",
                "status": "affected",
                "version": "8.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "communications_element_manager",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "8.2.2",
                "status": "affected",
                "version": "8.2.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "communications_evolved_communications_application_server",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "7.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.4.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "communications_instant_messaging_server",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "10.0.1.4.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "communications_network_charging_and_control",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "6.0.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:communications_network_charging_and_control:12.0.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "communications_network_charging_and_control",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "12.0.3",
                "status": "affected",
                "version": "12.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:communications_session_route_manager:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "communications_session_route_manager",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "8.2.2",
                "status": "affected",
                "version": "8.2.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "enterprise_manager_base_platform",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "13.4.0.0",
                "status": "affected",
                "version": "13.3.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.6:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "financial_services_analytical_applications_infrastructure",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "8.1.0",
                "status": "affected",
                "version": "8.0.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.6:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "financial_services_institutional_performance_analytics",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "8.0.6"
              },
              {
                "status": "affected",
                "version": "8.0.7"
              },
              {
                "status": "affected",
                "version": "8.1.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.6:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "financial_services_price_creation_and_discovery",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "8.0.7",
                "status": "affected",
                "version": "8.0.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:financial_services_retail_customer_analytics:8.0.6:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "financial_services_retail_customer_analytics",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "8.0.6"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "global_lifecycle_management_opatch",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "12.2.0.1.20",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:insurance_policy_administration_j2ee:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "insurance_policy_administration_j2ee",
            "vendor": "oracle",
            "versions": [
              {
                "lessThan": "11.1.0.15",
                "status": "affected",
                "version": "11.0.2.25",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jd_edwards_enterpriseone_orchestrator",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "9.2.4.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "primavera_unifier",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "16.1"
              },
              {
                "status": "affected",
                "version": "16.2"
              },
              {
                "lessThanOrEqual": "17.12",
                "status": "affected",
                "version": "17.7",
                "versionType": "custom"
              },
              {
                "status": "affected",
                "version": "18.8"
              },
              {
                "status": "affected",
                "version": "19.12"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:retail_merchandising_system:15.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "retail_merchandising_system",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "15.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:retail_sales_audit:14.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "retail_sales_audit",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "14.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:retail_service_backbone:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "retail_service_backbone",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "14.1"
              },
              {
                "status": "affected",
                "version": "15.0"
              },
              {
                "status": "affected",
                "version": "16.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "retail_xstore_point_of_service",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "19.0",
                "status": "affected",
                "version": "15.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:weblogic_server:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "weblogic_server",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "12.2.1.4.0",
                "status": "affected",
                "version": "12.2.1.3.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:fasterxml:jackson-databind:2.0.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jackson-databind",
            "vendor": "fasterxml",
            "versions": [
              {
                "lessThan": "2.9.10.4",
                "status": "affected",
                "version": "2.0.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2020-10968",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-25T04:00:46.867668Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-502",
                "description": "CWE-502 Deserialization of Untrusted Data",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T19:57:31.283Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:21:14.276Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[debian-lts-announce] 20200417 [SECURITY] [DLA 2179-1] jackson-databind security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200403-0002/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/FasterXML/jackson-databind/issues/2662"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-20T10:38:43",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[debian-lts-announce] 20200417 [SECURITY] [DLA 2179-1] jackson-databind security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200403-0002/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/issues/2662"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-10968",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[debian-lts-announce] 20200417 [SECURITY] [DLA 2179-1] jackson-databind security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html"
            },
            {
              "name": "https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062",
              "refsource": "MISC",
              "url": "https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200403-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200403-0002/"
            },
            {
              "name": "https://github.com/FasterXML/jackson-databind/issues/2662",
              "refsource": "MISC",
              "url": "https://github.com/FasterXML/jackson-databind/issues/2662"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-10968",
    "datePublished": "2020-03-26T12:43:45",
    "dateReserved": "2020-03-26T00:00:00",
    "dateUpdated": "2024-08-04T11:21:14.276Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2019-20330

Vulnerability from cvelistv5

Published

2020-01-03 03:35

Modified

2024-08-05 02:39

Severity ?

Summary

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.

References

▼	URL	Tags
	https://lists.apache.org/thread.html/rd6c6fef14944f3dcfb58d35f9317eb1c32a700e86c1b5231e45d3d0b%40%3Ccommits.druid.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rb532fed78d031fff477fd840b81946f6d1200f93a63698dae65aa528%40%3Ccommits.druid.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r5c3644c97f0434d1ceb48ff48897a67bdbf3baf7efbe7d04625425b3%40%3Ccommits.druid.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r7fb123e7dad49af5886cfec7135c0fd5b74e4c67af029e1dc91ba744%40%3Ccommits.druid.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d%40%3Cdev.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r5c14fdcabdeaba258857bcb67198652e4dce1d33ddc590cd81d82393%40%3Cdev.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r909c822409a276ba04dc2ae31179b16f6864ba02c4f9911bdffebf95%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r5d3d10fdf28110da3f9ac1b7d08d7e252f98d7d37ce0a6bd139a2e4f%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r50f513772f12e1babf65c7c2b9c16425bac2d945351879e2e267517f%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/ra8a80dbc7319916946397823aec0d893d24713cbf7b5aee0e957298c%40%3Cdev.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rfa57d9c2a27d3af14c69607fb1a3da00e758b2092aa88eb6a51b6e99%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/ra2e572f568de8df5ba151e6aebb225a0629faaf0476bf7c7ed877af8%40%3Cnotifications.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r428735963bee7cb99877b88d3228e28ec28af64646455c4f3e7a3c94%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/ra5ce96faec37c26b0aa15b4b6a8b1cbb145a748653e56ae83e9685d0%40%3Cnotifications.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rd1f346227e11fc515914f3a7b20d81543e51e5822ba71baa0452634a%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r7a0821b44247a1e6c6fe5f2943b90ebc4f80a8d1fb0aa9a8b29a59a2%40%3Ccommits.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r67f4d4c48197454b83d62afbed8bebbda3764e6e3a6e26a848961764%40%3Ccommits.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r707d23bb9ee245f50aa909add0da6e8d8f24719b1278ddd99d2428b2%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rd49cfa41bbb71ef33b53736a6af2aa8ba88c2106e30f2a34902a87d2%40%3Cnotifications.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r2c77dd6ab8344285bd8e481b57cf3029965a4b0036eefccef74cdd44%40%3Cnotifications.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r3f8180d0d25a7c6473ebb9714b0c1d19a73f455ae70d0c5fefc17e6c%40%3Cissues.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r8831b7fa5ca87a1cf23ee08d6dedb7877a964c1d2bd869af24056a63%40%3Ccommits.zookeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2020/02/msg00020.html	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpuapr2020.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://github.com/FasterXML/jackson-databind/issues/2526	x_refsource_MISC
	https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.10.1...jackson-databind-2.9.10.2	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20200127-0004/	x_refsource_CONFIRM
	https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
	https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T02:39:09.617Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[druid-commits] 20200114 [GitHub] [druid] ccaominh opened a new pull request #9189: Suppress CVE-2019-20330 for htrace-core-4.0.1",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rd6c6fef14944f3dcfb58d35f9317eb1c32a700e86c1b5231e45d3d0b%40%3Ccommits.druid.apache.org%3E"
          },
          {
            "name": "[druid-commits] 20200115 [GitHub] [druid] clintropolis merged pull request #9189: Suppress CVE-2019-20330 for htrace-core-4.0.1",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb532fed78d031fff477fd840b81946f6d1200f93a63698dae65aa528%40%3Ccommits.druid.apache.org%3E"
          },
          {
            "name": "[druid-commits] 20200115 [GitHub] [druid] ccaominh opened a new pull request #9191: [Backport] Suppress CVE-2019-20330 for htrace-core-4.0.1 (#9189)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r5c3644c97f0434d1ceb48ff48897a67bdbf3baf7efbe7d04625425b3%40%3Ccommits.druid.apache.org%3E"
          },
          {
            "name": "[druid-commits] 20200115 [GitHub] [druid] clintropolis merged pull request #9191: [Backport] Suppress CVE-2019-20330 for htrace-core-4.0.1 (#9189)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r7fb123e7dad49af5886cfec7135c0fd5b74e4c67af029e1dc91ba744%40%3Ccommits.druid.apache.org%3E"
          },
          {
            "name": "[druid-commits] 20200115 [druid] branch 0.17.0 updated: Suppress CVE-2019-20330 for htrace-core-4.0.1 (#9189) (#9191)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3E"
          },
          {
            "name": "[zookeeper-dev] 20200118 Build failed in Jenkins: zookeeper-master-maven-owasp #329",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d%40%3Cdev.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-dev] 20200118 [jira] [Created] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r5c14fdcabdeaba258857bcb67198652e4dce1d33ddc590cd81d82393%40%3Cdev.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200118 [jira] [Created] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r909c822409a276ba04dc2ae31179b16f6864ba02c4f9911bdffebf95%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200118 [jira] [Commented] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r5d3d10fdf28110da3f9ac1b7d08d7e252f98d7d37ce0a6bd139a2e4f%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200122 [jira] [Commented] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r50f513772f12e1babf65c7c2b9c16425bac2d945351879e2e267517f%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-dev] 20200122 Re: 3.5.7",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/ra8a80dbc7319916946397823aec0d893d24713cbf7b5aee0e957298c%40%3Cdev.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200122 [jira] [Assigned] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rfa57d9c2a27d3af14c69607fb1a3da00e758b2092aa88eb6a51b6e99%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-notifications] 20200122 [GitHub] [zookeeper] phunt commented on issue #1232: ZOOKEEPER-3699: upgrade jackson-databind to address CVE-2019-20330",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/ra2e572f568de8df5ba151e6aebb225a0629faaf0476bf7c7ed877af8%40%3Cnotifications.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200122 [jira] [Updated] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r428735963bee7cb99877b88d3228e28ec28af64646455c4f3e7a3c94%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-notifications] 20200122 [GitHub] [zookeeper] phunt opened a new pull request #1232: ZOOKEEPER-3699: upgrade jackson-databind to address CVE-2019-20330",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/ra5ce96faec37c26b0aa15b4b6a8b1cbb145a748653e56ae83e9685d0%40%3Cnotifications.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200123 [jira] [Commented] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rd1f346227e11fc515914f3a7b20d81543e51e5822ba71baa0452634a%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-commits] 20200123 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-3699: upgrade jackson-databind to address CVE-2019-20330",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r7a0821b44247a1e6c6fe5f2943b90ebc4f80a8d1fb0aa9a8b29a59a2%40%3Ccommits.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-commits] 20200123 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3699: upgrade jackson-databind to address CVE-2019-20330",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r67f4d4c48197454b83d62afbed8bebbda3764e6e3a6e26a848961764%40%3Ccommits.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200123 [jira] [Resolved] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r707d23bb9ee245f50aa909add0da6e8d8f24719b1278ddd99d2428b2%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-notifications] 20200123 [GitHub] [zookeeper] asfgit closed pull request #1232: ZOOKEEPER-3699: upgrade jackson-databind to address CVE-2019-20330",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rd49cfa41bbb71ef33b53736a6af2aa8ba88c2106e30f2a34902a87d2%40%3Cnotifications.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-notifications] 20200123 [GitHub] [zookeeper] nkalmar commented on issue #1232: ZOOKEEPER-3699: upgrade jackson-databind to address CVE-2019-20330",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r2c77dd6ab8344285bd8e481b57cf3029965a4b0036eefccef74cdd44%40%3Cnotifications.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200123 [jira] [Updated] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r3f8180d0d25a7c6473ebb9714b0c1d19a73f455ae70d0c5fefc17e6c%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-commits] 20200123 [zookeeper] branch master updated: ZOOKEEPER-3699: upgrade jackson-databind to address CVE-2019-20330",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r8831b7fa5ca87a1cf23ee08d6dedb7877a964c1d2bd869af24056a63%40%3Ccommits.zookeeper.apache.org%3E"
          },
          {
            "name": "[debian-lts-announce] 20200220 [SECURITY] [DLA 2111-1] jackson-databind security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/FasterXML/jackson-databind/issues/2526"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.10.1...jackson-databind-2.9.10.2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200127-0004/"
          },
          {
            "name": "[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E"
          },
          {
            "name": "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-07-20T22:53:45",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[druid-commits] 20200114 [GitHub] [druid] ccaominh opened a new pull request #9189: Suppress CVE-2019-20330 for htrace-core-4.0.1",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rd6c6fef14944f3dcfb58d35f9317eb1c32a700e86c1b5231e45d3d0b%40%3Ccommits.druid.apache.org%3E"
        },
        {
          "name": "[druid-commits] 20200115 [GitHub] [druid] clintropolis merged pull request #9189: Suppress CVE-2019-20330 for htrace-core-4.0.1",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb532fed78d031fff477fd840b81946f6d1200f93a63698dae65aa528%40%3Ccommits.druid.apache.org%3E"
        },
        {
          "name": "[druid-commits] 20200115 [GitHub] [druid] ccaominh opened a new pull request #9191: [Backport] Suppress CVE-2019-20330 for htrace-core-4.0.1 (#9189)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r5c3644c97f0434d1ceb48ff48897a67bdbf3baf7efbe7d04625425b3%40%3Ccommits.druid.apache.org%3E"
        },
        {
          "name": "[druid-commits] 20200115 [GitHub] [druid] clintropolis merged pull request #9191: [Backport] Suppress CVE-2019-20330 for htrace-core-4.0.1 (#9189)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r7fb123e7dad49af5886cfec7135c0fd5b74e4c67af029e1dc91ba744%40%3Ccommits.druid.apache.org%3E"
        },
        {
          "name": "[druid-commits] 20200115 [druid] branch 0.17.0 updated: Suppress CVE-2019-20330 for htrace-core-4.0.1 (#9189) (#9191)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3E"
        },
        {
          "name": "[zookeeper-dev] 20200118 Build failed in Jenkins: zookeeper-master-maven-owasp #329",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d%40%3Cdev.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-dev] 20200118 [jira] [Created] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r5c14fdcabdeaba258857bcb67198652e4dce1d33ddc590cd81d82393%40%3Cdev.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200118 [jira] [Created] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r909c822409a276ba04dc2ae31179b16f6864ba02c4f9911bdffebf95%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200118 [jira] [Commented] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r5d3d10fdf28110da3f9ac1b7d08d7e252f98d7d37ce0a6bd139a2e4f%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200122 [jira] [Commented] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r50f513772f12e1babf65c7c2b9c16425bac2d945351879e2e267517f%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-dev] 20200122 Re: 3.5.7",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/ra8a80dbc7319916946397823aec0d893d24713cbf7b5aee0e957298c%40%3Cdev.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200122 [jira] [Assigned] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rfa57d9c2a27d3af14c69607fb1a3da00e758b2092aa88eb6a51b6e99%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-notifications] 20200122 [GitHub] [zookeeper] phunt commented on issue #1232: ZOOKEEPER-3699: upgrade jackson-databind to address CVE-2019-20330",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/ra2e572f568de8df5ba151e6aebb225a0629faaf0476bf7c7ed877af8%40%3Cnotifications.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200122 [jira] [Updated] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r428735963bee7cb99877b88d3228e28ec28af64646455c4f3e7a3c94%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-notifications] 20200122 [GitHub] [zookeeper] phunt opened a new pull request #1232: ZOOKEEPER-3699: upgrade jackson-databind to address CVE-2019-20330",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/ra5ce96faec37c26b0aa15b4b6a8b1cbb145a748653e56ae83e9685d0%40%3Cnotifications.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200123 [jira] [Commented] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rd1f346227e11fc515914f3a7b20d81543e51e5822ba71baa0452634a%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-commits] 20200123 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-3699: upgrade jackson-databind to address CVE-2019-20330",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r7a0821b44247a1e6c6fe5f2943b90ebc4f80a8d1fb0aa9a8b29a59a2%40%3Ccommits.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-commits] 20200123 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3699: upgrade jackson-databind to address CVE-2019-20330",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r67f4d4c48197454b83d62afbed8bebbda3764e6e3a6e26a848961764%40%3Ccommits.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200123 [jira] [Resolved] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r707d23bb9ee245f50aa909add0da6e8d8f24719b1278ddd99d2428b2%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-notifications] 20200123 [GitHub] [zookeeper] asfgit closed pull request #1232: ZOOKEEPER-3699: upgrade jackson-databind to address CVE-2019-20330",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rd49cfa41bbb71ef33b53736a6af2aa8ba88c2106e30f2a34902a87d2%40%3Cnotifications.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-notifications] 20200123 [GitHub] [zookeeper] nkalmar commented on issue #1232: ZOOKEEPER-3699: upgrade jackson-databind to address CVE-2019-20330",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r2c77dd6ab8344285bd8e481b57cf3029965a4b0036eefccef74cdd44%40%3Cnotifications.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200123 [jira] [Updated] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r3f8180d0d25a7c6473ebb9714b0c1d19a73f455ae70d0c5fefc17e6c%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-commits] 20200123 [zookeeper] branch master updated: ZOOKEEPER-3699: upgrade jackson-databind to address CVE-2019-20330",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r8831b7fa5ca87a1cf23ee08d6dedb7877a964c1d2bd869af24056a63%40%3Ccommits.zookeeper.apache.org%3E"
        },
        {
          "name": "[debian-lts-announce] 20200220 [SECURITY] [DLA 2111-1] jackson-databind security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/issues/2526"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.10.1...jackson-databind-2.9.10.2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200127-0004/"
        },
        {
          "name": "[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E"
        },
        {
          "name": "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-20330",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[druid-commits] 20200114 [GitHub] [druid] ccaominh opened a new pull request #9189: Suppress CVE-2019-20330 for htrace-core-4.0.1",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rd6c6fef14944f3dcfb58d35f9317eb1c32a700e86c1b5231e45d3d0b@%3Ccommits.druid.apache.org%3E"
            },
            {
              "name": "[druid-commits] 20200115 [GitHub] [druid] clintropolis merged pull request #9189: Suppress CVE-2019-20330 for htrace-core-4.0.1",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb532fed78d031fff477fd840b81946f6d1200f93a63698dae65aa528@%3Ccommits.druid.apache.org%3E"
            },
            {
              "name": "[druid-commits] 20200115 [GitHub] [druid] ccaominh opened a new pull request #9191: [Backport] Suppress CVE-2019-20330 for htrace-core-4.0.1 (#9189)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r5c3644c97f0434d1ceb48ff48897a67bdbf3baf7efbe7d04625425b3@%3Ccommits.druid.apache.org%3E"
            },
            {
              "name": "[druid-commits] 20200115 [GitHub] [druid] clintropolis merged pull request #9191: [Backport] Suppress CVE-2019-20330 for htrace-core-4.0.1 (#9189)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r7fb123e7dad49af5886cfec7135c0fd5b74e4c67af029e1dc91ba744@%3Ccommits.druid.apache.org%3E"
            },
            {
              "name": "[druid-commits] 20200115 [druid] branch 0.17.0 updated: Suppress CVE-2019-20330 for htrace-core-4.0.1 (#9189) (#9191)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f@%3Ccommits.druid.apache.org%3E"
            },
            {
              "name": "[zookeeper-dev] 20200118 Build failed in Jenkins: zookeeper-master-maven-owasp #329",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d@%3Cdev.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-dev] 20200118 [jira] [Created] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r5c14fdcabdeaba258857bcb67198652e4dce1d33ddc590cd81d82393@%3Cdev.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200118 [jira] [Created] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r909c822409a276ba04dc2ae31179b16f6864ba02c4f9911bdffebf95@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200118 [jira] [Commented] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r5d3d10fdf28110da3f9ac1b7d08d7e252f98d7d37ce0a6bd139a2e4f@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200122 [jira] [Commented] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r50f513772f12e1babf65c7c2b9c16425bac2d945351879e2e267517f@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-dev] 20200122 Re: 3.5.7",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/ra8a80dbc7319916946397823aec0d893d24713cbf7b5aee0e957298c@%3Cdev.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200122 [jira] [Assigned] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rfa57d9c2a27d3af14c69607fb1a3da00e758b2092aa88eb6a51b6e99@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-notifications] 20200122 [GitHub] [zookeeper] phunt commented on issue #1232: ZOOKEEPER-3699: upgrade jackson-databind to address CVE-2019-20330",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/ra2e572f568de8df5ba151e6aebb225a0629faaf0476bf7c7ed877af8@%3Cnotifications.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200122 [jira] [Updated] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r428735963bee7cb99877b88d3228e28ec28af64646455c4f3e7a3c94@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-notifications] 20200122 [GitHub] [zookeeper] phunt opened a new pull request #1232: ZOOKEEPER-3699: upgrade jackson-databind to address CVE-2019-20330",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/ra5ce96faec37c26b0aa15b4b6a8b1cbb145a748653e56ae83e9685d0@%3Cnotifications.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200123 [jira] [Commented] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rd1f346227e11fc515914f3a7b20d81543e51e5822ba71baa0452634a@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-commits] 20200123 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-3699: upgrade jackson-databind to address CVE-2019-20330",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r7a0821b44247a1e6c6fe5f2943b90ebc4f80a8d1fb0aa9a8b29a59a2@%3Ccommits.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-commits] 20200123 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3699: upgrade jackson-databind to address CVE-2019-20330",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r67f4d4c48197454b83d62afbed8bebbda3764e6e3a6e26a848961764@%3Ccommits.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200123 [jira] [Resolved] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r707d23bb9ee245f50aa909add0da6e8d8f24719b1278ddd99d2428b2@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-notifications] 20200123 [GitHub] [zookeeper] asfgit closed pull request #1232: ZOOKEEPER-3699: upgrade jackson-databind to address CVE-2019-20330",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rd49cfa41bbb71ef33b53736a6af2aa8ba88c2106e30f2a34902a87d2@%3Cnotifications.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-notifications] 20200123 [GitHub] [zookeeper] nkalmar commented on issue #1232: ZOOKEEPER-3699: upgrade jackson-databind to address CVE-2019-20330",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r2c77dd6ab8344285bd8e481b57cf3029965a4b0036eefccef74cdd44@%3Cnotifications.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200123 [jira] [Updated] (ZOOKEEPER-3699) upgrade jackson-databind to address CVE-2019-20330",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r3f8180d0d25a7c6473ebb9714b0c1d19a73f455ae70d0c5fefc17e6c@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-commits] 20200123 [zookeeper] branch master updated: ZOOKEEPER-3699: upgrade jackson-databind to address CVE-2019-20330",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r8831b7fa5ca87a1cf23ee08d6dedb7877a964c1d2bd869af24056a63@%3Ccommits.zookeeper.apache.org%3E"
            },
            {
              "name": "[debian-lts-announce] 20200220 [SECURITY] [DLA 2111-1] jackson-databind security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00020.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
            },
            {
              "name": "https://github.com/FasterXML/jackson-databind/issues/2526",
              "refsource": "MISC",
              "url": "https://github.com/FasterXML/jackson-databind/issues/2526"
            },
            {
              "name": "https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.10.1...jackson-databind-2.9.10.2",
              "refsource": "MISC",
              "url": "https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.10.1...jackson-databind-2.9.10.2"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200127-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200127-0004/"
            },
            {
              "name": "[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E"
            },
            {
              "name": "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://www.oracle.com//security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-20330",
    "datePublished": "2020-01-03T03:35:52",
    "dateReserved": "2020-01-03T00:00:00",
    "dateUpdated": "2024-08-05T02:39:09.617Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_redhat

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature