Red Hat Security AdvisoryRHSA-2020:1644
pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
Released 2020-04-28 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
Fixes 12 records
Priority HIGH 71
FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.26587 · Published 2020-02-10 · Partial fix · 2.6.7.4, 2.7.9.7 +2 CWE-502
Priority HIGH 67
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.18383 · Published 2020-03-02 · Partial fix · 2.9.10.4, 2.8.11.6 +1 CWE-502
Priority HIGH 66
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.18921 · Published 2020-03-02 · Partial fix · 2.9.10.4, 2.8.11.6 +1 CWE-502
Priority MEDIUM 62
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.10763 · Published 2019-09-15 · Partial fix · 2.9.10, 2.8.11.5 +1 CWE-502
Priority MEDIUM 59
FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0864 · Published 2020-01-03 · Partial fix · 2.6.7.4, 2.7.9.7 +2 CWE-502
Priority MEDIUM 57
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.05373 · Published 2019-10-12 · Partial fix · 2.9.10.1, 2.8.11.5 +1 CWE-502
Priority MEDIUM 57
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.05681 · Published 2019-10-01 · Partial fix · 2.9.10.1, 2.8.11.5 +1 CWE-502
Priority MEDIUM 57
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04918 · Published 2019-09-15 · Partial fix · 2.9.10, 2.8.11.5 +1 CWE-502
Priority MEDIUM 56
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04741 · Published 2019-10-01 · Partial fix · 2.9.10.1, 2.8.11.5 +1 CWE-502
Priority MEDIUM 51
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.08028 · Published 2020-03-18 · Partial fix · 2.9.10.4, 2.6.7.4 CWE-502
Priority MEDIUM 49
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04575 · Published 2020-03-02 · Partial fix · 2.9.10.4 CWE-502
Priority MEDIUM 46
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jm…
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.03059 · Published 2020-03-18 · Partial fix · 2.9.10.4 CWE-502
THREATIST.IORead the docs