A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
92CF0272-B961-44D2-95F6-162A23169E1D
2.6.7.5
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
8D404972-B307-4BF1-A261-8E8E317301ED
2.9.10.7
2.7.0
OR
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*
F3E0B672-3E06-4422-B2A4-0BD073AEC2A1
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
B55E8D50-99B4-47EC-86F9-699B67D473CE
cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:*
5EC98B22-FFAA-4B59-8E63-EBAA4336AD13
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
F1BE6C1F-2565-4E97-92AA-16563E5660A5
cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*
7081652A-D28B-494E-94EF-CA88117F23EE
OR
cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*
6CBC8F5C-01FF-4F4E-9A86-550EDCAE8980
1.12.1
1.7.0
OR
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
DEECE5FC-CACF-4496-A3E7-164736409252
OR
cpe:2.3:a:oracle:commerce_guided_search_and_experience_manager:11.3.2:*:*:*:*:*:*:*
F6553225-EDFB-42D1-BCEC-6ACF35C08150
OR
Another gadget type(s) has been reported regarding a class(es) of JDK Swing.

See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Mitre id: CVE-2021-20190 (see https://nvd.nist.gov/vuln/detail/CVE-2021-20190)
Reporter(s): Yangkun(ICSL)

Fix is be included in:

* 2.9.10.7 (released 02-Dec-2020)
* 2.6.7.5 (released 22-Jun-2021)
* Not considered valid CVE for Jackson 2.10.0 and later (see https://medium.com/@cowtowncoder/jackson-2-10-safe-default-typing-2d018f0ce2ba)

Block one more gadget type (javax.swing, CVE-2020-20190)
This is a GitHub Issue
repo:jackson-databind
owner:FasterXML
Title : Block one more gadget type (javax.swing, CVE-2020-20190)
Issue date:

--- start body ---
Another gadget type(s) has been reported regarding a class(es) of JDK Swing.

See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Mitre id: CVE-2021-20190 (see https://nvd.nist.gov/vuln/detail/CVE-2021-20190)
Reporter(s): Yangkun(ICSL)

Fix is be included in:

* 2.9.10.7 (released 02-Dec-2020)
* 2.6.7.5 (released 22-Jun-2021)
* Not considered valid CVE for Jackson 2.10.0 and later (see https://medium.com/@cowtowncoder/jackson-2-10-safe-default-typing-2d018f0ce2ba)

--- end body ---

comments :
--- start comments ---

--- end comments ---