Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2020-8840GHSA-4W82-R329-3Q67

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyedi

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 2.6.7.4, 2.7.9.7, 2.8.11.5, 2.9.10.3
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: yes
  • Technical impact: total

Summary

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: yes · Technical impact: total

  3. Record last updated
  4. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • com.fasterxml.jackson.core:jackson-databindMaven

    From 2.0.0 · fixed in 2.6.7.4

  • com.fasterxml.jackson.core:jackson-databindMaven

    From 2.7.0 · fixed in 2.7.9.7

  • com.fasterxml.jackson.core:jackson-databindMaven

    From 2.8.0 · fixed in 2.8.11.5

  • com.fasterxml.jackson.core:jackson-databindMaven

    From 2.9.0 · fixed in 2.9.10.3

References 25

lists.apache.org

lists.debian.org