Read the docs
TI-2020-15666 Aliases CVE-2020-25649GHSA-288c-cq4h-88gq

XML external entity injection in jackson-databind

Priority MEDIUM 56CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 19 fixed, 17 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.17714 97th percentileScored 2026-11-07
Fix Partial com.fasterxml.jackson.core:jackson-databind (Maven): 2.6.7.4, 2.9.10.7, 2.10.5.1Red Hat: 18 advisoriesRed Hat: 19 fixed, 17 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—jackson-databindjackson-databind-2.11.0—No fix listedCNA
—com.fasterxml.jackson.core:jackson-databind (Maven)2.6.0 to before 2.6.7.42.6.7.4Patch availableGHSA-288c-cq4h-88gq
—com.fasterxml.jackson.core:jackson-databind (Maven)2.7.0.0 to before 2.9.10.72.9.10.7Patch availableGHSA-288c-cq4h-88gq
—com.fasterxml.jackson.core:jackson-databind (Maven)2.10.0.0 to before 2.10.5.12.10.5.1Patch availableGHSA-288c-cq4h-88gq
  • jackson-databind Vendor— Affected jackson-databind-2.11.0 Fixed in — No fix listed CNA
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.6.0 to before 2.6.7.4 Fixed in 2.6.7.4 Patch available GHSA-288c-cq4h-88gq
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.7.0.0 to before 2.9.10.7 Fixed in 2.9.10.7 Patch available GHSA-288c-cq4h-88gq
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.10.0.0 to before 2.10.5.1 Fixed in 2.10.5.1 Patch available GHSA-288c-cq4h-88gq

CPE configurations NVD · 68

CPEVersionsRoleVendor
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*2.6.0 to before 2.6.7.4; 2.9.0 to before 2.9.10.7; 2.10.0 to before 2.10.5.1VulnerableFasterXML
cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*up to 1.6.1Vulnerablequarkusio
cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:*before 0.12.0VulnerableApache
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*9.3.6VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management_integration_pack:3.6:*:*:*:*:e-business_suite:*:*3.6VulnerableOracle
cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:*18.1 – 18.3VulnerableOracle
  • cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions 2.6.0 to before 2.6.7.4; 2.9.0 to before 2.9.10.7; 2.10.0 to before 2.10.5.1 Vulnerable ·FasterXML
  • cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions up to 1.6.1 Vulnerable ·quarkusio
  • cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:* Versions before 0.12.0 Vulnerable ·Apache
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* Versions 9.3.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management_integration_pack:3.6:*:*:*:*:e-business_suite:*:* Versions 3.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:* Versions 18.1 – 18.3 Vulnerable ·Oracle
Show 58 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:*19.1VulnerableOracle
cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:*19.2VulnerableOracle
cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:*20.1VulnerableOracle
cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:*21.1VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*2.6.2VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:*2.7.0VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*2.7.1VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.8.0:*:*:*:*:*:*:*2.8.0VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*2.9.0VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.10.0:*:*:*:*:*:*:*2.10.0VulnerableOracle
cpe:2.3:a:oracle:banking_treasury_management:4.4:*:*:*:*:*:*:*4.4VulnerableOracle
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*before 21.1.2VulnerableOracle
cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:*14.1.1.0.0VulnerableOracle
cpe:2.3:a:oracle:commerce_platform:*:*:*:*:*:*:*:*11.3.0 – 11.3.2VulnerableOracle
cpe:2.3:a:oracle:commerce_platform:11.2.0:*:*:*:*:*:*:*11.2.0VulnerableOracle
cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*7.5.0.23.0VulnerableOracle
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*12.0.0.3.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_convergent_charging_controller:12.0.4.0.0:*:*:*:*:*:*:*12.0.4.0.0VulnerableOracle
cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*7.1VulnerableOracle
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:*10.0.1.5.0VulnerableOracle
cpe:2.3:a:oracle:communications_interactive_session_recorder:6.3:*:*:*:*:*:*:*6.3VulnerableOracle
cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4:*:*:*:*:*:*:*6.4VulnerableOracle
cpe:2.3:a:oracle:communications_network_charging_and_control:12.0.4.0.0:*:*:*:*:*:*:*12.0.4.0.0VulnerableOracle
cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3:*:*:*:*:*:*:*12.0.0.3VulnerableOracle
cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.4.0:*:*:*:*:*:*:*12.0.0.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*7.0VulnerableOracle
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*7.4.1VulnerableOracle
cpe:2.3:a:oracle:goldengate_application_adapters:19.1.0.0.0:*:*:*:*:*:*:*19.1.0.0.0VulnerableOracle
cpe:2.3:a:oracle:health_sciences_empirica_signal:9.0:*:*:*:*:*:*:*9.0VulnerableOracle
cpe:2.3:a:oracle:health_sciences_empirica_signal:9.1:*:*:*:*:*:*:*9.1VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:*11.1.0 – 11.3.0VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration:11.0.2:*:*:*:*:*:*:*11.0.2VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:*:*:*:*:*:*:*:*11.1.0 – 11.3.0VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:11.0.2:*:*:*:*:*:*:*11.0.2VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:*before 9.2.5.3VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*before 9.2.5.3VulnerableOracle
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*17.7 – 17.12; 17.12.0 – 17.12.11; 18.8.0 – 18.8.11; 19.12.0 – 19.12.10VulnerableOracle
cpe:2.3:a:oracle:primavera_gateway:20.12.0:*:*:*:*:*:*:*20.12.0VulnerableOracle
cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2:*:*:*:*:*:*:*14.1.3.2VulnerableOracle
cpe:2.3:a:oracle:retail_service_backbone:15.0.3.1:*:*:*:*:*:*:*15.0.3.1VulnerableOracle
cpe:2.3:a:oracle:retail_service_backbone:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*16.0.6VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*17.0.4VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*18.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*19.0.2VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*20.0.1VulnerableOracle
cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*9.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.3.0.5.0:*:*:*:*:*:*:*4.3.0.5.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:*:*:*:*:*:*:*4.3.0.6.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*4.4.0.0.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:*4.4.0.2.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:*4.4.0.3.0VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:o:oracle:communications_messaging_server:8.0.2:*:*:*:*:*:*:*8.0.2VulnerableOracle
cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*8.1VulnerableOracle
  • cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:* Versions 19.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:* Versions 19.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:* Versions 20.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:* Versions 21.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.8.0:*:*:*:*:*:*:* Versions 2.8.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:* Versions 2.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.10.0:*:*:*:*:*:*:* Versions 2.10.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_treasury_management:4.4:*:*:*:*:*:*:* Versions 4.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* Versions before 21.1.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:* Versions 14.1.1.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:commerce_platform:*:*:*:*:*:*:*:* Versions 11.3.0 – 11.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:commerce_platform:11.2.0:*:*:*:*:*:*:* Versions 11.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:* Versions 7.5.0.23.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_convergent_charging_controller:12.0.4.0.0:*:*:*:*:*:*:* Versions 12.0.4.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:* Versions 10.0.1.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_interactive_session_recorder:6.3:*:*:*:*:*:*:* Versions 6.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4:*:*:*:*:*:*:* Versions 6.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_network_charging_and_control:12.0.4.0.0:*:*:*:*:*:*:* Versions 12.0.4.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3:*:*:*:*:*:*:* Versions 12.0.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.4.0:*:*:*:*:*:*:* Versions 12.0.0.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:* Versions 7.4.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:goldengate_application_adapters:19.1.0.0.0:*:*:*:*:*:*:* Versions 19.1.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:health_sciences_empirica_signal:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:health_sciences_empirica_signal:9.1:*:*:*:*:*:*:* Versions 9.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:* Versions 11.1.0 – 11.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration:11.0.2:*:*:*:*:*:*:* Versions 11.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:*:*:*:*:*:*:*:* Versions 11.1.0 – 11.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:11.0.2:*:*:*:*:*:*:* Versions 11.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:* Versions before 9.2.5.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* Versions before 9.2.5.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* Versions 17.7 – 17.12; 17.12.0 – 17.12.11; 18.8.0 – 18.8.11; 19.12.0 – 19.12.10 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_gateway:20.12.0:*:*:*:*:*:*:* Versions 20.12.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2:*:*:*:*:*:*:* Versions 14.1.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_service_backbone:15.0.3.1:*:*:*:*:*:*:* Versions 15.0.3.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_service_backbone:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:* Versions 16.0.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:* Versions 17.0.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:* Versions 18.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:* Versions 19.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:* Versions 20.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.3.0.5.0:*:*:*:*:*:*:* Versions 4.3.0.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:*:*:*:*:*:*:* Versions 4.3.0.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:* Versions 4.4.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:* Versions 4.4.0.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:* Versions 4.4.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:o:oracle:communications_messaging_server:8.0.2:*:*:*:*:*:*:* Versions 8.0.2 Vulnerable ·Oracle
  • cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-288c-cq4h-88gq com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.6.7.4 Advisory →
  • Fix · GHSA-288c-cq4h-88gq com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.9.10.7 Advisory →
  • Fix · GHSA-288c-cq4h-88gq com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.10.5.1 Advisory →

Red Hat 18 advisories

  • RHSA-2021:2476 Released 2021-06-17 · Red Hat rating Moderate
    Red Hat Decision Manager 7.11.0 security update
    • RHDM 7.11.0
  • RHSA-2021:2475 Released 2021-06-17 · Red Hat rating Moderate
    Red Hat Process Automation Manager 7.11.0 security update
    • RHPAM 7.11.0
  • RHSA-2021:2039 Released 2021-05-19 · Red Hat rating Moderate
    Service Registry (container images) release and security update [1.1.1.GA]
    • Red Hat Integration
Show 15 more Red Hat advisories
  • RHSA-2021:1429 Released 2021-05-05 · Red Hat rating Low
    OpenShift Container Platform 4.6.27 security and extras update
    • Red Hat OpenShift Container Platform 4.6 openshift4/ose-logging-elasticsearch6
  • RHSA-2021:1260 Released 2021-04-19 · Red Hat rating Low
    Red Hat AMQ Streams 1.7.0 release and security update
    • Red Hat AMQ Streams 1.7.0
  • RHSA-2021:0811 Released 2021-03-11 · Red Hat rating Low
    Red Hat Integration Tech-Preview 3 Camel K security update
    • Red Hat Integration - Camel K - Tech-Preview 3
  • RHSA-2021:0381 Released 2021-02-02 · Red Hat rating Low
    RHV-M(ovirt-engine) 4.4.z security, bug fix, enhancement update [ovirt-4.4.4]
    • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-engine-4.4.4.5-0.10.el8ev, ovirt-engine-backend-4.4.4.5-0.10.el8ev, ovirt-engine-dbscripts-4.4.4.5-0.10.el8ev +23
  • RHSA-2020:5361 Released 2020-12-16 · Red Hat rating Important
    Red Hat build of Thorntail 2.7.2 security and bug fix update
    • Text-Only RHOAR
  • RHSA-2020:5533 Released 2020-12-15 · Red Hat rating Important
    Red Hat Single Sign-On 7.4.4 security update
    • Red Hat Single Sign-On 7
  • RHSA-2020:5410 Released 2020-12-14 · Red Hat rating Important
    Red Hat Data Grid 7.3.8 security update
    • Red Hat Data Grid 7.3.8
  • RHSA-2020:5342 Released 2020-12-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.4 security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-activemq-artemis-2.9.0-6.redhat_00016.1.el8eap, eap7-activemq-artemis-cli-2.9.0-6.redhat_00016.1.el8eap, eap7-activemq-artemis-commons-2.9.0-6.redhat_00016.1.el8eap +47
  • RHSA-2020:5341 Released 2020-12-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.4 security update
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-activemq-artemis-2.9.0-6.redhat_00016.1.el7eap, eap7-activemq-artemis-cli-2.9.0-6.redhat_00016.1.el7eap, eap7-activemq-artemis-commons-2.9.0-6.redhat_00016.1.el7eap +47
  • RHSA-2020:5340 Released 2020-12-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.4 security update
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-activemq-artemis-2.9.0-6.redhat_00016.1.el6eap, eap7-activemq-artemis-cli-2.9.0-6.redhat_00016.1.el6eap, eap7-activemq-artemis-commons-2.9.0-6.redhat_00016.1.el6eap +47
  • RHSA-2020:5344 Released 2020-12-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.4 security update
    • Red Hat JBoss Enterprise Application Platform 7
  • RHSA-2020:4379 Released 2020-11-09 · Red Hat rating Important
    Red Hat build of Eclipse Vert.x 3.9.4 security update
    • Vert.x 3.9.4
  • RHSA-2020:4401 Released 2020-10-28 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3 security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-jackson-databind-2.10.4-1.redhat_00002.1.el8eap
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-jackson-databind-2.10.4-1.redhat_00002.1.el6eap
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-jackson-databind-2.10.4-1.redhat_00002.1.el7eap
  • RHSA-2020:4402 Released 2020-10-28 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3 security update
    • Red Hat JBoss Enterprise Application Platform 7
  • RHSA-2020:4312 Released 2020-10-22 · Red Hat rating Important
    rh-maven35-jackson-databind security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-maven35-jackson-databind-2.7.6-2.12.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.12.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-maven35-jackson-databind-2.7.6-2.12.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.12.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-maven35-jackson-databind-2.7.6-2.12.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.12.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-maven35-jackson-databind-2.7.6-2.12.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.12.el7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
A-MQ Clients 2AffectedNo fix yet
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Fuse 7AffectedNo fix yet
Red Hat Integration Camel K 1AffectedNo fix yet
Red Hat JBoss A-MQ 6AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat OpenShift Container Platform 3.11AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat Satellite 6AffectedNo fix yet
Red Hat build of QuarkusAffectedNo fix yet
RHDM 7.11.0Fixed RHSA-2021:2476
RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4Fixed RHSA-2021:0381
RHPAM 7.11.0Fixed RHSA-2021:2475
Red Hat AMQ Streams 1.7.0Fixed RHSA-2021:1260
Red Hat Data Grid 7.3.8Fixed RHSA-2020:5410
Red Hat IntegrationFixed RHSA-2021:2039
Red Hat Integration - Camel K - Tech-Preview 3Fixed RHSA-2021:0811
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2020:4401, RHSA-2020:5342
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2020:4401, RHSA-2020:5340
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2020:4401, RHSA-2020:5341
Red Hat JBoss Enterprise Application Platform 7Fixed RHSA-2020:4402
Red Hat OpenShift Container Platform 4.6Fixed RHSA-2021:1429
Red Hat Single Sign-On 7Fixed RHSA-2020:5533
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:4312
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2020:4312
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2020:4312
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:4312
Text-Only RHOARFixed RHSA-2020:5361
Vert.x 3.9.4Fixed RHSA-2020:4379
Not affected: 4 products
  • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • Red Hat Data Grid 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-25649
  2. 2026-10-03 Alias added: GHSA-288c-cq4h-88gq
  3. 2026-10-08 CISA SSVC decision points changed
  4. 2026-11-04 Fix available: Red Hat Single Sign-On 7 · Red Hat

References

Patch 7

Advisory 4

Other 127

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences