FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
2F87CF67-6994-43F1-BEC3-DD7D122D0146
2.7.9.7
2.0.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
BF323F3D-B2A4-41E7-94F9-5539C9B7025E
2.8.11.5
2.8.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
4B316C68-EEEF-436D-9570-907CAC8F0507
2.9.10.3
2.9.0
OR
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43
OR
cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:*
5EC98B22-FFAA-4B59-8E63-EBAA4336AD13
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
5735E553-9731-4AAC-BCFF-989377F817B3
cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*
7081652A-D28B-494E-94EF-CA88117F23EE
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
E94F7F59-1785-493F-91A7-5F5EA5E87E4D
OR
cpe:2.3:o:huawei:oceanstor_9000_firmware:v300r006c20:*:*:*:*:*:*:*
99FB89BE-A430-4540-B1B5-5F8458E79AF2
cpe:2.3:o:huawei:oceanstor_9000_firmware:v300r006c20spc100:*:*:*:*:*:*:*
0AA58161-B5CA-44CE-B16B-A09D86CB7A9E
cpe:2.3:o:huawei:oceanstor_9000_firmware:v300r006c20spc200:*:*:*:*:*:*:*
DBC5C81D-495A-432B-A3A8-B208BB2270F2
cpe:2.3:o:huawei:oceanstor_9000_firmware:v300r006c20spc300:*:*:*:*:*:*:*
066EEFAA-917D-40BF-8D92-AE8CBEC0312D
OR
cpe:2.3:h:huawei:oceanstor_9000:-:*:*:*:*:*:*:*
AEC54023-CF84-4095-A3E8-2D6E334768E9
OR
AND
cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*
F6455EB1-C741-45E8-A53E-E7AD7A5D00EE
11.2.0.3.23
cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*
BFD43191-E67F-4D1B-967B-3C7B20331945
12.2.0.1.19
12.2.0.1.0
cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*
062C588A-CBBA-470F-8D11-2F961922E927
13.9.4.2.1
13.9.4.0.0
OR
Another gadget (*) type reported related to JNDI access.
See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Mitre id: CVE-2020-8840
Original discoverer: @threedr3am

Fixed in:

* 2.9.10.3 (`jackson-bom` version `2.9.10.20200223`)
* 2.8.11.5 (`jackson-bom` version `2.8.11.20200210`)
* 2.7.9.7
* does not affect 2.10.0 and later

Block one more gadget type (xbean-reflect/JNDI - CVE-2020-8840)
This is a GitHub Issue
repo:jackson-databind
owner:FasterXML
Title : Block one more gadget type (xbean-reflect/JNDI - CVE-2020-8840)
Issue date:

--- start body ---
Another gadget (*) type reported related to JNDI access.
See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Mitre id: CVE-2020-8840
Original discoverer: @threedr3am

Fixed in:

* 2.9.10.3 (`jackson-bom` version `2.9.10.20200223`)
* 2.8.11.5 (`jackson-bom` version `2.8.11.20200210`)
* 2.7.9.7
* does not affect 2.10.0 and later

--- end body ---

comments :
--- start comments ---

--- end comments ---