A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
238F4D80-C84C-4C96-B45D-D73ADE46A3C8
2.9.10.4
OR
cpe:2.3:a:oracle:retail_merchandising_system:15.0:*:*:*:*:*:*:*
792DF04A-2D1B-40B5-B960-3E7152732EB8
cpe:2.3:a:oracle:retail_sales_audit:14.1:*:*:*:*:*:*:*
7DA6E92C-AC3B-40CF-96AE-22CD8769886F
OR
Another gadget type reported regarding a class of `ignite-jta`.
See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Mitre id:  CVE-2020-10650
Reporter: Srikanth Ramu, threedr3am'follower (2 concurrent reports)

Fix will be included in:

* 2.9.10.4
* Does not affect 2.10.0 and later

Block one more gadget type (ignite-jta, CVE-2020-10650)
This is a GitHub Issue
repo:jackson-databind
owner:FasterXML
Title : Block one more gadget type (ignite-jta, CVE-2020-10650)
Issue date:

--- start body ---
Another gadget type reported regarding a class of `ignite-jta`.
See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Mitre id:  CVE-2020-10650
Reporter: Srikanth Ramu, threedr3am'follower (2 concurrent reports)

Fix will be included in:

* 2.9.10.4
* Does not affect 2.10.0 and later

--- end body ---

comments :
--- start comments ---

--- end comments ---