Read the docs
TI-2020-18507 Aliases CVE-2020-36187GHSA-r695-7vr9-jgc2

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between…

Priority MEDIUM 50CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 fixed, 8 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04237 91st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial com.fasterxml.jackson.core:jackson-databind (Maven): 2.9.10.8Red Hat: 2 advisoriesRed Hat: 2 fixed, 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.fasterxml.jackson.core:jackson-databind (Maven)2.0.0 to before 2.9.10.82.9.10.8Patch availableGHSA-r695-7vr9-jgc2
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.0.0 to before 2.9.10.8 Fixed in 2.9.10.8 Patch available GHSA-r695-7vr9-jgc2

CPE configurations NVD · 72

CPEVersionsRoleVendor
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*2.0.0 to before 2.6.7.5; 2.7.0 to before 2.9.10.8VulnerableFasterXML
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*9.3.6VulnerableOracle
cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*13.3.0.1VulnerableOracle
cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:*21.0.2VulnerableOracle
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2:*:*:*:*:*:*:*14.2VulnerableOracle
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3:*:*:*:*:*:*:*14.3VulnerableOracle
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5:*:*:*:*:*:*:*14.5VulnerableOracle
  • cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.6.7.5; 2.7.0 to before 2.9.10.8 Vulnerable ·FasterXML
  • cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* Versions 9.3.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* Versions 13.3.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:* Versions 21.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2:*:*:*:*:*:*:* Versions 14.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3:*:*:*:*:*:*:* Versions 14.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
Show 62 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2:*:*:*:*:*:*:*14.2VulnerableOracle
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3:*:*:*:*:*:*:*14.3VulnerableOracle
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5:*:*:*:*:*:*:*14.5VulnerableOracle
cpe:2.3:a:oracle:banking_extensibility_workbench:14.2:*:*:*:*:*:*:*14.2VulnerableOracle
cpe:2.3:a:oracle:banking_extensibility_workbench:14.3:*:*:*:*:*:*:*14.3VulnerableOracle
cpe:2.3:a:oracle:banking_extensibility_workbench:14.5:*:*:*:*:*:*:*14.5VulnerableOracle
cpe:2.3:a:oracle:banking_supply_chain_finance:14.2:*:*:*:*:*:*:*14.2VulnerableOracle
cpe:2.3:a:oracle:banking_supply_chain_finance:14.3:*:*:*:*:*:*:*14.3VulnerableOracle
cpe:2.3:a:oracle:banking_supply_chain_finance:14.5:*:*:*:*:*:*:*14.5VulnerableOracle
cpe:2.3:a:oracle:banking_treasury_management:4.4:*:*:*:*:*:*:*4.4VulnerableOracle
cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:*14.2.0VulnerableOracle
cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:*14.3.0VulnerableOracle
cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:*14.5.0VulnerableOracle
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*up to 21.1.2VulnerableOracle
cpe:2.3:a:oracle:commerce_platform:*:*:*:*:*:*:*:*11.3.0 – 11.3.2VulnerableOracle
cpe:2.3:a:oracle:commerce_platform:11.2.0:*:*:*:*:*:*:*11.2.0VulnerableOracle
cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*7.5.0.23.0VulnerableOracle
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*12.0.0.3.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*1.14.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_convergent_charging_controller:12.0.4.0.0:*:*:*:*:*:*:*12.0.4.0.0VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_signaling_route:*:*:*:*:*:*:*:*8.0.0.0 – 8.5.0.0VulnerableOracle
cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*8.2.0.0 – 8.2.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*7.1VulnerableOracle
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:*10.0.1.5.0VulnerableOracle
cpe:2.3:a:oracle:communications_network_charging_and_control:12.0.4.0.0:*:*:*:*:*:*:*12.0.4.0.0VulnerableOracle
cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3:*:*:*:*:*:*:*12.0.0.3VulnerableOracle
cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*12.5.0VulnerableOracle
cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.4.0:*:*:*:*:*:*:*12.0.0.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*7.0VulnerableOracle
cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*8.0.0.0 – 8.2.2.1VulnerableOracle
cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*8.2.0.0 – 8.2.2.1VulnerableOracle
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*7.4.1VulnerableOracle
cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:documaker:12.6.0:*:*:*:*:*:*:*12.6.0VulnerableOracle
cpe:2.3:a:oracle:documaker:12.6.3:*:*:*:*:*:*:*12.6.3VulnerableOracle
cpe:2.3:a:oracle:documaker:12.6.4:*:*:*:*:*:*:*12.6.4VulnerableOracle
cpe:2.3:a:oracle:goldengate_application_adapters:19.1.0.0.0:*:*:*:*:*:*:*19.1.0.0.0VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:*11.1.0 – 11.3.0VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration:11.0.2:*:*:*:*:*:*:*11.0.2VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:*:*:*:*:*:*:*:*11.1.0 – 11.3.0VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:11.0.2:*:*:*:*:*:*:*11.0.2VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:*before 9.2.5.3VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*before 9.2.5.3VulnerableOracle
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*17.12.0 – 17.12.11; 18.8.0 – 18.8.11; 19.12.0 – 19.12.10VulnerableOracle
cpe:2.3:a:oracle:primavera_gateway:20.12.0:*:*:*:*:*:*:*20.12.0VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*17.7 – 17.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:17.2:*:*:*:*:*:*:*17.2VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*18.8VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*19.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*20.12VulnerableOracle
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:*:*:*:*:*:*:*:*16.0 – 19.0VulnerableOracle
cpe:2.3:a:oracle:retail_merchandising_system:15.0.3:*:*:*:*:*:*:*15.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2:*:*:*:*:*:*:*14.1.3.2VulnerableOracle
cpe:2.3:a:oracle:retail_service_backbone:15.0.3.1:*:*:*:*:*:*:*15.0.3.1VulnerableOracle
cpe:2.3:a:oracle:retail_service_backbone:16.0.3.0:*:*:*:*:*:*:*16.0.3.0VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*16.0.6VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*17.0.4VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*18.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*19.0.2VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
  • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2:*:*:*:*:*:*:* Versions 14.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3:*:*:*:*:*:*:* Versions 14.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_extensibility_workbench:14.2:*:*:*:*:*:*:* Versions 14.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_extensibility_workbench:14.3:*:*:*:*:*:*:* Versions 14.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_extensibility_workbench:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_supply_chain_finance:14.2:*:*:*:*:*:*:* Versions 14.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_supply_chain_finance:14.3:*:*:*:*:*:*:* Versions 14.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_supply_chain_finance:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_treasury_management:4.4:*:*:*:*:*:*:* Versions 4.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* Versions up to 21.1.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:commerce_platform:*:*:*:*:*:*:*:* Versions 11.3.0 – 11.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:commerce_platform:11.2.0:*:*:*:*:*:*:* Versions 11.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:* Versions 7.5.0.23.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_convergent_charging_controller:12.0.4.0.0:*:*:*:*:*:*:* Versions 12.0.4.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_signaling_route:*:*:*:*:*:*:*:* Versions 8.0.0.0 – 8.5.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:* Versions 8.2.0.0 – 8.2.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:* Versions 10.0.1.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_network_charging_and_control:12.0.4.0.0:*:*:*:*:*:*:* Versions 12.0.4.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3:*:*:*:*:*:*:* Versions 12.0.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:* Versions 12.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.4.0:*:*:*:*:*:*:* Versions 12.0.0.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* Versions 8.0.0.0 – 8.2.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* Versions 8.2.0.0 – 8.2.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:* Versions 7.4.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:documaker:12.6.0:*:*:*:*:*:*:* Versions 12.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:documaker:12.6.3:*:*:*:*:*:*:* Versions 12.6.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:documaker:12.6.4:*:*:*:*:*:*:* Versions 12.6.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:goldengate_application_adapters:19.1.0.0.0:*:*:*:*:*:*:* Versions 19.1.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:* Versions 11.1.0 – 11.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration:11.0.2:*:*:*:*:*:*:* Versions 11.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:*:*:*:*:*:*:*:* Versions 11.1.0 – 11.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:11.0.2:*:*:*:*:*:*:* Versions 11.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:* Versions before 9.2.5.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* Versions before 9.2.5.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* Versions 17.12.0 – 17.12.11; 18.8.0 – 18.8.11; 19.12.0 – 19.12.10 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_gateway:20.12.0:*:*:*:*:*:*:* Versions 20.12.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* Versions 17.7 – 17.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:17.2:*:*:*:*:*:*:* Versions 17.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* Versions 19.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* Versions 20.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:*:*:*:*:*:*:*:* Versions 16.0 – 19.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_merchandising_system:15.0.3:*:*:*:*:*:*:* Versions 15.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2:*:*:*:*:*:*:* Versions 14.1.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_service_backbone:15.0.3.1:*:*:*:*:*:*:* Versions 15.0.3.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_service_backbone:16.0.3.0:*:*:*:*:*:*:* Versions 16.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:* Versions 16.0.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:* Versions 17.0.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:* Versions 18.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:* Versions 19.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-r695-7vr9-jgc2 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.9.10.8 Advisory →

Red Hat 2 advisories

  • RHSA-2021:1515 Released 2021-05-06 · Red Hat rating Important
    Openshift Logging Bug Fix Release (5.0.3)
    • OpenShift Logging 5.0 openshift-logging/elasticsearch6-rhel8, openshift-logging/eventrouter-rhel8
  • RHSA-2021:1230 Released 2021-04-27 · Red Hat rating Important
    OpenShift Container Platform 4.6.26 security and extras update
    • Red Hat OpenShift Container Platform 4.6 openshift4/ose-logging-elasticsearch6

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
OpenShift Logging 5.0Fixed RHSA-2021:1515
Red Hat OpenShift Container Platform 4.6Fixed RHSA-2021:1230
Not affected: 23 products
  • A-MQ Clients 2
  • OpenShift Logging 5.0
  • Red Hat Data Grid 8
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat Integration Service Registry
  • Red Hat JBoss A-MQ 6
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat JBoss Fuse 6
  • Red Hat OpenShift Application Runtimes
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.6
  • Red Hat Process Automation 7
  • Red Hat Satellite 6
  • Red Hat Single Sign-On 7
  • Red Hat build of Quarkus
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-36187
  2. 2026-10-03 Alias added: GHSA-r695-7vr9-jgc2
  3. 2026-10-08 CISA SSVC decision points changed

References

Exploit 1

Patch 4

Advisory 6

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences