FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
4B92AF50-0155-471E-B5C4-1CFD95F4B7D0
2.9.10.5
2.9.0
OR
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:linux:*:*
9FBC1BD0-FF12-4691-8751-5F245D991989
7.3
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*
BD075607-09B7-493E-8611-66D041FFDA62
7.3
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*
0CB28AF5-5AF0-4475-A7B6-12E1795FFDCB
9.5
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
E94F7F59-1785-493F-91A7-5F5EA5E87E4D
OR
cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
C650FEDB-E903-4C2D-AD40-282AB5F2E3C2
cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:*
BBE7BF09-B89C-4590-821E-6C0587E096B5
cpe:2.3:a:oracle:banking_digital_experience:18.2:*:*:*:*:*:*:*
ADAE8A71-0BCD-42D5-B38C-9B2A27CC1E6B
cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:*
E7231D2D-4092-44F3-B60A-D7C9ED78AFDF
cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:*
F7BDFC10-45A0-46D8-AB92-4A5E2C1C76ED
cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:*
18127694-109C-4E7E-AE79-0BA351849291
cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*
33F68878-BC19-4DB8-8A72-BD9FE3D0ACEC
cpe:2.3:a:oracle:communications_calendar_server:8.0.0.4.0:*:*:*:*:*:*:*
46059231-E7F6-4402-8119-1C7FE4ABEA96
cpe:2.3:a:oracle:communications_contacts_server:8.0.0.5.0:*:*:*:*:*:*:*
D01A0BBC-DA0E-4AFE-83BF-4F3BA01653EC
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*
526E2FE5-263F-416F-8628-6CD40B865780
8.2.2
8.0.0
cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*
B51F78F4-8D7E-48C2-86D1-D53A6EB348A7
8.2.2
8.2.0
cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*
987811D5-DA5E-493D-8709-F9231A84E5F9
cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*
3E5416A1-EE58-415D-9645-B6A875EBAED2
8.2.2
8.2.0
cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*
11B0C37E-D7C7-45F2-A8D8-5A3B1B191430
8.2.2
8.2.0
OR
Another gadget type(s) reported regarding class(es) of  `org.apache.drill.exec:drill-jdbc-all`. library.
See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Mitre id: CVE-2020-14060
Reporter(s): Topsec(tcc) from Alphalab Security Team

Fix is included in:

* 2.9.10.5
* Not considered valid CVE for Jackson 2.10.0 and later (see https://medium.com/@cowtowncoder/jackson-2-10-safe-default-typing-2d018f0ce2ba)

Block one more gadget type (apache-drill, CVE-2020-14060)
This is a GitHub Issue
repo:jackson-databind
owner:FasterXML
Title : Block one more gadget type (apache-drill, CVE-2020-14060)
Issue date:

--- start body ---
Another gadget type(s) reported regarding class(es) of  `org.apache.drill.exec:drill-jdbc-all`. library.
See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Mitre id: CVE-2020-14060
Reporter(s): Topsec(tcc) from Alphalab Security Team

Fix is included in:

* 2.9.10.5
* Not considered valid CVE for Jackson 2.10.0 and later (see https://medium.com/@cowtowncoder/jackson-2-10-safe-default-typing-2d018f0ce2ba)

--- end body ---

comments :
--- start comments ---

--- end comments ---