A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
2C23395F-4438-4B80-9DA6-87E760F7459A
2.6.7.4
2.6.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
7703D07D-5784-47D1-9391-D376A24D7C5A
2.9.10.7
2.9.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
28C07803-813B-4AAC-9C08-9EB83756F16B
2.10.5.1
2.10.0
OR
cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:*
5EC98B22-FFAA-4B59-8E63-EBAA4336AD13
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
5735E553-9731-4AAC-BCFF-989377F817B3
cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*
7081652A-D28B-494E-94EF-CA88117F23EE
OR
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
36D96259-24BD-44E2-96D9-78CE1D41F956
OR
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*
ADFFB9C4-DE43-4ADC-B1C7-6F034741D9C3
1.6.1
OR
cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:*
8C798AD5-AAF5-4044-B348-336F4CFA86CF
0.12.0
OR
cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
C650FEDB-E903-4C2D-AD40-282AB5F2E3C2
cpe:2.3:a:oracle:agile_product_lifecycle_management_integration_pack:3.6:*:*:*:*:e-business_suite:*:*
5B62CB3B-FDDF-4AFF-A47E-6ADE6504D451
cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:*
6DF2D056-3118-4C31-BEDD-69F016898CBB
18.3
18.1
cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:*
CF34B11F-3DE1-4C22-8EB1-AEE5CE5E4172
cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:*
86F03B63-F922-45CD-A7D1-326DB0042875
cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:*
7CBFC93F-8B39-45A2-981C-59B187169BD4
cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:*
0843465C-F940-4FFC-998D-9A2668B75EA0
cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*
132CE62A-FBFC-4001-81EC-35D81F73AF48
cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:*
282150FF-C945-4A3E-8A80-E8757A8907EA
cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*
645AA3D1-C8B5-4CD2-8ACE-31541FA267F0
cpe:2.3:a:oracle:banking_platform:2.8.0:*:*:*:*:*:*:*
FBCE22C0-4253-40A5-89AE-499A3BC9EFF3
cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*
AB9FC9AB-1070-420F-870E-A5EC43A924A4
cpe:2.3:a:oracle:banking_platform:2.10.0:*:*:*:*:*:*:*
3C5C28ED-C5AA-40B9-9B26-6A91D20B3E1A
cpe:2.3:a:oracle:banking_treasury_management:4.4:*:*:*:*:*:*:*
180F3D2A-7E7A-4DE9-9792-942CB3D6B51E
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*
D0DBC938-A782-433F-8BF1-CA250C332AA7
21.1.2
cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:*
2FF57C7A-92C9-4D71-A7B1-CC9DEFAA8193
cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:*
5FA64A1D-34F9-4441-857A-25C165E6DBB6
cpe:2.3:a:oracle:commerce_platform:*:*:*:*:*:*:*:*
F012E976-E219-46C2-8177-60ED859594BE
11.3.2
11.3.0
cpe:2.3:a:oracle:commerce_platform:11.2.0:*:*:*:*:*:*:*
21BEF2FC-89B8-4D97-BB3A-C1ECA19D03B5
cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*
790A89FD-6B86-49AE-9B4F-AE7262915E13
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*
E39D442D-1997-49AF-8B02-5640BE2A26CC
cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.4.0:*:*:*:*:*:*:*
AB1BC31C-6016-42A8-9517-2FBBC92620CC
cpe:2.3:a:oracle:communications_convergent_charging_controller:12.0.4.0.0:*:*:*:*:*:*:*
4012B512-DB7D-476A-93A6-51054DD6E3D0
cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*
987811D5-DA5E-493D-8709-F9231A84E5F9
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:*
C4A94B36-479F-48F2-9B9E-ACEA2589EF48
cpe:2.3:a:oracle:communications_interactive_session_recorder:6.3:*:*:*:*:*:*:*
46E23F2E-6733-45AF-9BD9-1A600BD278C8
cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4:*:*:*:*:*:*:*
E812639B-EE28-4C68-9F6F-70C8BF981C86
cpe:2.3:a:oracle:communications_network_charging_and_control:12.0.4.0.0:*:*:*:*:*:*:*
28AD22B9-A037-419C-8D72-8B062E6882FE
cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3:*:*:*:*:*:*:*
A23B00C1-878A-4B55-B87B-EFFFA6A5E622
cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.4.0:*:*:*:*:*:*:*
A28F42F0-FBDA-4574-AD30-7A04F27FEA3E
cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*
062E4E7C-55BB-46F3-8B61-5A663B565891
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*
A7637F8B-15F1-42E2-BE18-E1FF7C66587D
cpe:2.3:a:oracle:goldengate_application_adapters:19.1.0.0.0:*:*:*:*:*:*:*
E7BE0590-31BD-4FCD-B50E-A5F86196F99E
cpe:2.3:a:oracle:health_sciences_empirica_signal:9.0:*:*:*:*:*:*:*
2051BA9E-E635-47D5-B942-8AC26E9487CB
cpe:2.3:a:oracle:health_sciences_empirica_signal:9.1:*:*:*:*:*:*:*
9EA81FC1-63E1-479F-941C-930351E43010
cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:*
1DDB3D8B-1D04-4345-BB27-723186719CBD
11.3.0
11.1.0
cpe:2.3:a:oracle:insurance_policy_administration:11.0.2:*:*:*:*:*:*:*
0F89EC4B-6D34-40F0-B7C6-C03D03F81C13
cpe:2.3:a:oracle:insurance_rules_palette:*:*:*:*:*:*:*:*
5DEAB5CD-4223-4A43-AB9E-486113827A6C
11.3.0
11.1.0
cpe:2.3:a:oracle:insurance_rules_palette:11.0.2:*:*:*:*:*:*:*
F3E25293-CB03-44CE-A8ED-04B3A0487A6A
cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:*
A0A366B8-1B5C-4C9E-A761-1AB1547D7404
9.2.5.3
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
4BCA7DD9-8599-4E43-9D82-999BE15483B9
9.2.5.3
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*
6951D244-845C-4BF2-AC75-F226B0C39C77
17.12
17.7
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*
8B1C88FD-C2EC-4C96-AC7E-6F95C8763B48
17.12.11
17.12.0
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*
53E2276C-9515-46F6-A621-213A3047B9A6
18.8.11
18.8.0
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*
3EF7E2B4-B741-41E9-8EF6-6C415AB9EF54
19.12.10
19.12.0
cpe:2.3:a:oracle:primavera_gateway:20.12.0:*:*:*:*:*:*:*
4A932C79-8646-4023-9C12-9C7A2A6840EC
cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2:*:*:*:*:*:*:*
E702EBED-DB39-4084-84B1-258BC5FE7545
cpe:2.3:a:oracle:retail_service_backbone:15.0.3.1:*:*:*:*:*:*:*
3F7956BF-D5B6-484B-999C-36B45CD8B75B
cpe:2.3:a:oracle:retail_service_backbone:16.0.3:*:*:*:*:*:*:*
DEE71EA5-B315-4F1E-BFEE-EC426B562F7E
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*
490B2C44-CECD-4551-B04F-4076D0E053C7
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*
DEC41EB8-73B4-4BDF-9321-F34EC0BAF9E6
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*
48EFC111-B01B-4C34-87E4-D6B2C40C0122
cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*
073FEA23-E46A-4C73-9D29-95CFF4F5A59D
cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*
A69FB468-EAF3-4E67-95E7-DF92C281C1F1
cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*
77E39D5C-5EFA-4FEB-909E-0A92004F2563
cpe:2.3:a:oracle:utilities_framework:4.3.0.5.0:*:*:*:*:*:*:*
A5BBA303-8D2B-48C5-B52A-4E192166699C
cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:*:*:*:*:*:*:*
8DF02546-3F0D-4FDD-89B1-8A3FE43FB5BF
cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*
3F906F04-39E4-4BE4-8A73-9D058AAADB43
cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:*
7B393A82-476A-4270-A903-38ED4169E431
cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:*
85CAE52B-C2CA-4C6B-A0B7-2B9D6F0499E2
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
D6A4F71A-4269-40FC-8F61-1D1301F2B728
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
5A502118-5B2B-47AE-82EC-1999BD841103
cpe:2.3:o:oracle:communications_messaging_server:8.0.2:*:*:*:*:*:*:*
E819270D-AA7D-4B0E-990B-D25AB6E46FBC
cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*
7569C0BD-16C1-441E-BAEB-840C94BE73EF
OR
As per description:
https://github.com/FasterXML/jackson-databind/blob/master/src/main/java/com/fasterxml/jackson/databind/ext/DOMDeserializer.java#L30
and
https://github.com/FasterXML/jackson-databind/blob/master/src/main/java/com/fasterxml/jackson/databind/ext/DOMDeserializer.java#L33

is not enough to stop expansion of entities. Depending on provider(xerces) being used it might work with current DOMDeserializer or not. If JDK default is used(at least one that I used at time of test), it wont allow to expand entities, however, if other provider from classpath is used it might, for instance, xerces-2.12....  does allow( iirc) expansion.

Reference: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxp-documentbuilderfactory-saxparserfactory-and-dom4j

I tinkered a bit with databind classes and I had something like:
```java
factory.setValidating(true);
factory.setExpandEntityReferences(false);
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
```


`DOMDeserializer`: setExpandEntityReferences(false) may not prevent external entity expansion in all cases [CVE-2020-25649]
This is a GitHub Issue
repo:jackson-databind
owner:FasterXML
Title : `DOMDeserializer`: setExpandEntityReferences(false) may not prevent external entity expansion in all cases [CVE-2020-25649]
Issue date:

--- start body ---
As per description:
https://github.com/FasterXML/jackson-databind/blob/master/src/main/java/com/fasterxml/jackson/databind/ext/DOMDeserializer.java#L30
and
https://github.com/FasterXML/jackson-databind/blob/master/src/main/java/com/fasterxml/jackson/databind/ext/DOMDeserializer.java#L33

is not enough to stop expansion of entities. Depending on provider(xerces) being used it might work with current DOMDeserializer or not. If JDK default is used(at least one that I used at time of test), it wont allow to expand entities, however, if other provider from classpath is used it might, for instance, xerces-2.12....  does allow( iirc) expansion.

Reference: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxp-documentbuilderfactory-saxparserfactory-and-dom4j

I tinkered a bit with databind classes and I had something like:
```java
factory.setValidating(true);
factory.setExpandEntityReferences(false);
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
```


--- end body ---

comments :
--- start comments ---

--- end comments ---