FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
4892ABAA-57A0-43D3-965C-2D7F4A8A6024
2.6.7.5
2.0.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
96DBACC5-AC30-4F2A-9615-DDC912A188B0
2.9.10.6
2.7.0
OR
cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
C650FEDB-E903-4C2D-AD40-282AB5F2E3C2
cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*
A125E817-F974-4509-872C-B71933F42AD1
cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:*
97994257-C9A4-4491-B362-E8B25B7187AB
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:*
0CF9A061-2421-426D-9854-0A4E55B2961D
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:*
F95EDC3D-54BB-48F9-82F2-7CCF335FCA78
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:*
B72B735F-4E52-484A-9C2C-23E6E2070385
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:*
8B36A1D4-F391-4EE3-9A65-0A10568795BA
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:*
55116032-AAD1-4FEA-9DA8-2C4CBD3D3F61
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:*
0275F820-40BE-47B8-B167-815A55DF578E
cpe:2.3:a:oracle:banking_liquidity_management:14.2:*:*:*:*:*:*:*
B7FC2BF9-B6D7-420E-9CF5-21AB770B9CC1
cpe:2.3:a:oracle:banking_liquidity_management:14.3:*:*:*:*:*:*:*
D4DAB919-54FD-48F8-A664-CD85C0A4A0E7
cpe:2.3:a:oracle:banking_liquidity_management:14.5:*:*:*:*:*:*:*
9D5A1417-2C59-431F-BF5C-A2BCFEBC95FD
cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:*
6A8420D4-AAF1-44AA-BF28-48EE3ED310B9
cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:*
2FB80AC5-35F2-4703-AD93-416B46972EEB
cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:*
19DAAEFF-AB4A-4D0D-8C86-D2F2811B53B1
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*
D0DBC938-A782-433F-8BF1-CA250C332AA7
21.1.2
cpe:2.3:a:oracle:communications_calendar_server:8.0:*:*:*:*:*:*:*
5D55AB36-EDBB-4644-9579-21CE8278ED77
cpe:2.3:a:oracle:communications_calendar_server:8.0.0.4.0:*:*:*:*:*:*:*
46059231-E7F6-4402-8119-1C7FE4ABEA96
cpe:2.3:a:oracle:communications_contacts_server:8.0:*:*:*:*:*:*:*
AE6D7E4F-FB11-4CED-81DB-D0BD21797C53
cpe:2.3:a:oracle:communications_contacts_server:8.0.0.5.0:*:*:*:*:*:*:*
D01A0BBC-DA0E-4AFE-83BF-4F3BA01653EC
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*
526E2FE5-263F-416F-8628-6CD40B865780
8.2.2
8.0.0
cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*
0331877D-D5DB-4EE8-8220-C1CDC3F90CB0
8.2.4.0
8.2.0
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:*
C4A94B36-479F-48F2-9B9E-ACEA2589EF48
cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*
E1214FDF-357A-4BB9-BADE-50FB2BD16D10
cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3.0:*:*:*:*:*:*:*
49ACFC73-A509-4D1C-8FC3-F68F495AB055
cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*
5312AC7A-3C16-4967-ACA6-317289A749D0
cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.4.0:*:*:*:*:*:*:*
A28F42F0-FBDA-4574-AD30-7A04F27FEA3E
cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*
062E4E7C-55BB-46F3-8B61-5A663B565891
cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*
FB3E2625-08F0-4C8E-B43F-831F0290F0D7
8.2.2.1
8.0.0.0
cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*
F5AA3C04-30A4-4975-B878-C5777F8BB918
8.2.2.1
8.2.0
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*
A7637F8B-15F1-42E2-BE18-E1FF7C66587D
cpe:2.3:a:oracle:identity_manager_connector:11.1.1.5.0:*:*:*:*:*:*:*
9D7EA92D-9F26-4292-991A-891597337DFD
cpe:2.3:a:oracle:siebel_core_-_server_framework:*:*:*:*:*:*:*:*
F9C855EA-6E35-4EFF-ADEB-0EDFF90272BD
21.5
cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*
0D9E0011-6FF5-4C90-9780-7A1297BB09BF
21.2
OR
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
DEECE5FC-CACF-4496-A3E7-164736409252
OR
Another gadget type(s) reported regarding class(es) of `com.pastdev.httpcomponents:configuration`. library.
See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Mitre id: CVE-2020-24750
Reporter(s): Al1ex@knownsec

Fix is included in:

* 2.9.10.6 (usable via `jackson-bom` version `2.9.10.20200824`)
* 2.6.7.5
* Not considered valid CVE for Jackson 2.10.0 and later (see https://medium.com/@cowtowncoder/jackson-2-10-safe-default-typing-2d018f0ce2ba)


Block one more gadget type (com.pastdev.httpcomponents, CVE-2020-24750)
This is a GitHub Issue
repo:jackson-databind
owner:FasterXML
Title : Block one more gadget type (com.pastdev.httpcomponents, CVE-2020-24750)
Issue date:

--- start body ---
Another gadget type(s) reported regarding class(es) of `com.pastdev.httpcomponents:configuration`. library.
See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Mitre id: CVE-2020-24750
Reporter(s): Al1ex@knownsec

Fix is included in:

* 2.9.10.6 (usable via `jackson-bom` version `2.9.10.20200824`)
* 2.6.7.5
* Not considered valid CVE for Jackson 2.10.0 and later (see https://medium.com/@cowtowncoder/jackson-2-10-safe-default-typing-2d018f0ce2ba)


--- end body ---

comments :
--- start comments ---

--- end comments ---