FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
49F38029-9D32-499B-B5D4-C4FFDD9B1728
2.9.10.8
2.0.0
OR
cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*
7081652A-D28B-494E-94EF-CA88117F23EE
OR
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
DEECE5FC-CACF-4496-A3E7-164736409252
OR
cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
C650FEDB-E903-4C2D-AD40-282AB5F2E3C2
cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*
A125E817-F974-4509-872C-B71933F42AD1
cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:*
97994257-C9A4-4491-B362-E8B25B7187AB
cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*
132CE62A-FBFC-4001-81EC-35D81F73AF48
cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:*
282150FF-C945-4A3E-8A80-E8757A8907EA
cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*
645AA3D1-C8B5-4CD2-8ACE-31541FA267F0
cpe:2.3:a:oracle:banking_platform:2.8.0:*:*:*:*:*:*:*
FBCE22C0-4253-40A5-89AE-499A3BC9EFF3
cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*
AB9FC9AB-1070-420F-870E-A5EC43A924A4
cpe:2.3:a:oracle:banking_platform:2.10.0:*:*:*:*:*:*:*
3C5C28ED-C5AA-40B9-9B26-6A91D20B3E1A
cpe:2.3:a:oracle:banking_treasury_management:14.4:*:*:*:*:*:*:*
AB612B4A-27C4-491E-AABD-6CAADE2E249E
cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:*
D1534C11-E3F5-49F3-8F8D-7C5C90951E69
cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:*
D952E04D-DE2D-4AE0-BFE6-7D9B7E55AC80
cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:*
1111BCFD-E336-4B31-A87E-76C684AC6DE4
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*
2A50522C-E7AC-4F6F-A340-CF6173FA4D4E
21.1.2
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*
4479F76A-4B67-41CC-98C7-C76B81050F8E
cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.4.0:*:*:*:*:*:*:*
AB1BC31C-6016-42A8-9517-2FBBC92620CC
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*
C88D46AF-459D-4917-9403-0F63FEC83512
8.5.0
8.0.0
cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*
987811D5-DA5E-493D-8709-F9231A84E5F9
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:*
C4A94B36-479F-48F2-9B9E-ACEA2589EF48
cpe:2.3:a:oracle:communications_interactive_session_recorder:6.3:*:*:*:*:*:*:*
46E23F2E-6733-45AF-9BD9-1A600BD278C8
cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4:*:*:*:*:*:*:*
E812639B-EE28-4C68-9F6F-70C8BF981C86
cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3:*:*:*:*:*:*:*
A23B00C1-878A-4B55-B87B-EFFFA6A5E622
cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.4.0:*:*:*:*:*:*:*
A28F42F0-FBDA-4574-AD30-7A04F27FEA3E
cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*
062E4E7C-55BB-46F3-8B61-5A663B565891
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*
A7637F8B-15F1-42E2-BE18-E1FF7C66587D
cpe:2.3:a:oracle:documaker:12.6.3:*:*:*:*:*:*:*
34019365-E6E3-4DBC-89EA-5783A29B61B0
cpe:2.3:a:oracle:documaker:12.6.4:*:*:*:*:*:*:*
3A1427F8-50F3-45B2-8836-A80ADA70F431
cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.2.0:*:*:*:*:*:*:*
D56B4193-4DB7-4BD9-85FF-8665601E6D4F
cpe:2.3:a:oracle:retail_merchandising_system:15.0.3:*:*:*:*:*:*:*
E7C9BB48-50B2-4735-9E2F-E492C708C36D
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*
490B2C44-CECD-4551-B04F-4076D0E053C7
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*
DEC41EB8-73B4-4BDF-9321-F34EC0BAF9E6
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*
48EFC111-B01B-4C34-87E4-D6B2C40C0122
cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*
073FEA23-E46A-4C73-9D29-95CFF4F5A59D
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
D6A4F71A-4269-40FC-8F61-1D1301F2B728
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
5A502118-5B2B-47AE-82EC-1999BD841103
OR
Another gadget type(s) reported regarding class(es) of `org.apache.commons:commons-dbcp2`. library.
See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Reporter(s): Al1ex@knownsec
Mitre ids:
    * CVE-2020-35490
    * CVE-2020-35491

Fix is included in:

* 2.9.10.8 (usable via `jackson-bom` version `2.9.10.20210106`)
* 2.6.7.5
* Not considered valid CVE for Jackson 2.10.0 and later (see https://medium.com/@cowtowncoder/jackson-2-10-safe-default-typing-2d018f0ce2ba)

Block 2 more gadget types (commons-dbcp2, CVE-2020-35490/CVE-2020-35491)
This is a GitHub Issue
repo:jackson-databind
owner:FasterXML
Title : Block 2 more gadget types (commons-dbcp2, CVE-2020-35490/CVE-2020-35491)
Issue date:

--- start body ---
Another gadget type(s) reported regarding class(es) of `org.apache.commons:commons-dbcp2`. library.
See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Reporter(s): Al1ex@knownsec
Mitre ids:
    * CVE-2020-35490
    * CVE-2020-35491

Fix is included in:

* 2.9.10.8 (usable via `jackson-bom` version `2.9.10.20210106`)
* 2.6.7.5
* Not considered valid CVE for Jackson 2.10.0 and later (see https://medium.com/@cowtowncoder/jackson-2-10-safe-default-typing-2d018f0ce2ba)

--- end body ---

comments :
--- start comments ---

--- end comments ---