ID

VAR-202003-1785


CVE

CVE-2020-11113


TITLE

FasterXML jackson-databind  Untrusted data deserialization vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2020-003617

DESCRIPTION

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa). FasterXML jackson-databind contains an untrusted data deserialization vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. FasterXML Jackson is a data processing tool for Java developed by American FasterXML Company. jackson-databind is one of the components with data binding function. A security vulnerability exists in FasterXML jackson-databind 2.x versions prior to 2.9.10.4. Currently there is no information about this vulnerability, please keep an eye on CNNVD or vendor announcements. Description: Red Hat Decision Manager is an open source decision management platform that combines business rules management, complex event processing, Decision Model & Notation (DMN) execution, and Business Optimizer for solving planning problems. It automates business decisions and makes that logic available to the entire business. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process. Security Fix(es): * apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default (CVE-2019-10086) * cxf: does not restrict the number of message attachments (CVE-2019-12406) * cxf: OpenId Connect token service does not properly validate the clientId (CVE-2019-12419) * hibernate-validator: safeHTML validator allows XSS (CVE-2019-10219) * HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512) * HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514) * HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515) * HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511) * jackson-databind: Multiple serialization gadgets (CVE-2019-17531, CVE-2019-16943, CVE-2019-16942, CVE-2019-17267, CVE-2019-14540, CVE-2019-16335, CVE-2019-14893, CVE-2019-14892, CVE-2020-9546, CVE-2020-9547, CVE-2020-9548, CVE-2020-10969, CVE-2020-10968, CVE-2020-11111, CVE-2020-11112, CVE-2020-11113, CVE-2020-11619, CVE-2020-11620, CVE-2019-20330, CVE-2020-8840) * jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution (CVE-2020-10672, CVE-2020-10673) * keycloak: adapter endpoints are exposed via arbitrary URLs (CVE-2019-14820) * keycloak: missing signatures validation on CRL used to verify client certificates (CVE-2019-3875) * keycloak: SAML broker does not check existence of signature on document allowing any user impersonation (CVE-2019-10201) * keycloak: CSRF check missing in My Resources functionality in the Account Console (CVE-2019-10199) * keycloak: cross-realm user access auth bypass (CVE-2019-14832) * netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238) * SmallRye: SecuritySupport class is incorrectly public and contains a static method to access the current threads context class loader (CVE-2020-1729) * thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol (CVE-2019-0210) * thrift: Endless loop when feed with specific input data (CVE-2019-0205) * undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS (CVE-2019-14888) * wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use (CVE-2019-14887) * wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and 'Deployer' user by default (CVE-2019-14838) * xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source (CVE-2019-12400) For more details about the security issues and their impact, the CVSS score, acknowledgements, and other related information, see the CVE pages listed in the References section. You must be logged in to download the update. NOTE: This advisory is an addendum to https://access.redhat.com/errata/RHBA-2020:1414 and is an informational advisory only, to clarify security fixes released therein. No code has been modified as part of this advisory. Description: Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Description: Red Hat Data Grid is a distributed, in-memory, NoSQL datastore based on the Infinispan project. This release of Red Hat Data Grid 7.3.7 serves as a replacement for Red Hat Data Grid 7.3.6 and includes bug fixes and enhancements, which are described in the Release Notes, linked to in the References section of this erratum. Solution: To install this update, do the following: 1. Download the Data Grid 7.3.7 server patch from the customer portal. See the download link in the References section. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on. Install the Data Grid 7.3.7 server patch. Refer to the 7.3 Release Notes for patching instructions. Restart Data Grid to ensure the changes take effect. Bugs fixed (https://bugzilla.redhat.com/): 1595621 - CVE-2017-7658 jetty: Incorrect header handling 1715075 - CVE-2019-10172 jackson-mapper-asl: XML external entity similar to CVE-2016-3720 1730462 - CVE-2020-1695 resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class 1752770 - CVE-2020-1757 undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass 1793970 - CVE-2020-1710 EAP: field-name is not parsed in accordance to RFC7230 1796617 - CVE-2020-1719 Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain 1807305 - CVE-2020-1745 undertow: AJP File Read/Inclusion Vulnerability 1807707 - CVE-2020-1748 Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain 1815470 - CVE-2020-10673 jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution 1815495 - CVE-2020-10672 jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution 1816216 - CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes 1816330 - CVE-2020-8840 jackson-databind: Lacks certain xbean-reflect/JNDI blocking 1816332 - CVE-2020-9546 jackson-databind: Serialization gadgets in shaded-hikari-config 1816337 - CVE-2020-9547 jackson-databind: Serialization gadgets in ibatis-sqlmap 1816340 - CVE-2020-9548 jackson-databind: Serialization gadgets in anteros-core 1819208 - CVE-2020-10968 jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider 1819212 - CVE-2020-10969 jackson-databind: Serialization gadgets in javax.swing.JEditorPane 1821304 - CVE-2020-11111 jackson-databind: Serialization gadgets in org.apache.activemq.jms.pool.XaPooledConnectionFactory 1821311 - CVE-2020-11112 jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider 1821315 - CVE-2020-11113 jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime 1825714 - CVE-2020-10714 wildfly-elytron: session fixation when using FORM authentication 1826798 - CVE-2020-11620 jackson-databind: Serialization gadgets in commons-jelly:commons-jelly 1826805 - CVE-2020-11619 jackson-databind: Serialization gadgets in org.springframework:spring-aop 1831139 - CVE-2020-9488 log4j: improper validation of certificate with host mismatch in SMTP appender 5. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Installation instructions are available from the Fuse 7.7.0 product documentation page: https://access.redhat.com/documentation/en-us/red_hat_fuse/7.7/ 4. Bugs fixed (https://bugzilla.redhat.com/): 1343616 - CVE-2016-4970 netty: Infinite loop vulnerability when handling renegotiation using SslProvider.OpenSsl 1620529 - CVE-2018-1000632 dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents 1632452 - CVE-2018-3831 elasticsearch: Information exposure via _cluster/settings API 1637492 - CVE-2018-11797 pdfbox: unbounded computation in parser resulting in a denial of service 1638391 - CVE-2018-12541 vertx: WebSocket HTTP upgrade implementation holds the entire http request in memory before the handshake 1697598 - CVE-2019-3797 spring-data-jpa: Additional information exposure with Spring Data JPA derived queries 1700016 - CVE-2019-0231 mina-core: Retaining an open socket in close_notify SSL-TLS leading to Information disclosure. 1713468 - CVE-2019-12086 jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: rh-maven35-jackson-databind security update Advisory ID: RHSA-2020:1523-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2020:1523 Issue date: 2020-04-21 Cross references: 1822587 1822174 1822932 1822937 1822927 CVE Names: CVE-2020-10968 CVE-2020-10969 CVE-2020-11111 CVE-2020-11112 CVE-2020-11113 ===================================================================== 1. Summary: An update for rh-maven35-jackson-databind is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch 3. Description: The jackson-databind package provides general data-binding functionality for Jackson, which works on top of Jackson core streaming API. Security Fix(es): * jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider (CVE-2020-10968) * jackson-databind: Serialization gadgets in javax.swing.JEditorPane (CVE-2020-10969) * jackson-databind: Serialization gadgets in org.apache.activemq.jms.pool.XaPooledConnectionFactory (CVE-2020-11111) * jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider (CVE-2020-11112) * jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime (CVE-2020-11113) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1819208 - CVE-2020-10968 jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider 1819212 - CVE-2020-10969 jackson-databind: Serialization gadgets in javax.swing.JEditorPane 1821304 - CVE-2020-11111 jackson-databind: Serialization gadgets in org.apache.activemq.jms.pool.XaPooledConnectionFactory 1821311 - CVE-2020-11112 jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider 1821315 - CVE-2020-11113 jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-maven35-jackson-databind-2.7.6-2.9.el7.src.rpm noarch: rh-maven35-jackson-databind-2.7.6-2.9.el7.noarch.rpm rh-maven35-jackson-databind-javadoc-2.7.6-2.9.el7.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-maven35-jackson-databind-2.7.6-2.9.el7.src.rpm noarch: rh-maven35-jackson-databind-2.7.6-2.9.el7.noarch.rpm rh-maven35-jackson-databind-javadoc-2.7.6-2.9.el7.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5): Source: rh-maven35-jackson-databind-2.7.6-2.9.el7.src.rpm noarch: rh-maven35-jackson-databind-2.7.6-2.9.el7.noarch.rpm rh-maven35-jackson-databind-javadoc-2.7.6-2.9.el7.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6): Source: rh-maven35-jackson-databind-2.7.6-2.9.el7.src.rpm noarch: rh-maven35-jackson-databind-2.7.6-2.9.el7.noarch.rpm rh-maven35-jackson-databind-javadoc-2.7.6-2.9.el7.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7): Source: rh-maven35-jackson-databind-2.7.6-2.9.el7.src.rpm noarch: rh-maven35-jackson-databind-2.7.6-2.9.el7.noarch.rpm rh-maven35-jackson-databind-javadoc-2.7.6-2.9.el7.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: rh-maven35-jackson-databind-2.7.6-2.9.el7.src.rpm noarch: rh-maven35-jackson-databind-2.7.6-2.9.el7.noarch.rpm rh-maven35-jackson-databind-javadoc-2.7.6-2.9.el7.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-10968 https://access.redhat.com/security/cve/CVE-2020-10969 https://access.redhat.com/security/cve/CVE-2020-11111 https://access.redhat.com/security/cve/CVE-2020-11112 https://access.redhat.com/security/cve/CVE-2020-11113 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXp7oOtzjgjWX9erEAQghsBAAk6mN7QOctoM4gV9BDkYybnwjFrgzSgQg LahdpBV7QmHQ/6rdhSlbE8sGCdrUwLJy1GvRS1PzvUY2IzLf8c0rtzcHrIiD1wWB N5kEBWiNgHOpuU4etwbR9gGsY7hhSvyxzTyRhHU36UQJqyNoc95DfbokqeAf8Ggp dfw20J8hsCkQ6OkvDCM6T9fY7jcbHdiD4jx8WSMn3bQS3o8zRf1JJlMPOqLnHM+J 998+RIzoJYqqdL7XNWPMopvR1yps2Xx+NTL4+2Vg8e+2KVxO+ksIu3EqRsCRD0wT 22iPNX3r8ETjWcfLGw0Imvc8RiRsCL7L4oa+cbIpnBdvsRr/yW8IYmvJmHwFTZlK +vIyYPAfSCLuHSktXEwZ9WDMeFsJfZr+zdVZ5MmOgvMAIqg+0RSE3VBlzmuAOMbv yNz6SPODozvMDPmW1OwLhtGsu1CigORIuTRcNSYwTkXVoAxFhWXK0sHuxc3h1ne0 x38Tgk1grF7xbBSfvJwFn0MfBhufg4+iUuFhte7mtuSu3gvjQ/qt01Oo11p8cW2m g6lX1NGEsUpEONf0NS+1hFSxWB4ex7ln98e5AqNWtLHt3S5OHzI67+/4dgl5xF7J PdLv4j8b1AqTV8wRX6pK59OeslYcPhYdMWHEbMSkQJ3WZFOILkyTm6HWer9kl3Yt 8yoMyLl6FBM= =n1if -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Relevant releases/architectures: 6Client-AMQ-Clients-2 - i386, noarch, x86_64 6ComputeNode-AMQ-Clients-2 - noarch, x86_64 6Server-AMQ-Clients-2 - i386, noarch, x86_64 6Workstation-AMQ-Clients-2 - i386, noarch, x86_64 7Client-AMQ-Clients-2 - noarch, x86_64 7ComputeNode-AMQ-Clients-2 - noarch, x86_64 7Server-AMQ-Clients-2 - noarch, x86_64 7Workstation-AMQ-Clients-2 - noarch, x86_64 8Base-AMQ-Clients-2 - noarch, x86_64 3. Description: Red Hat AMQ Clients enable connecting, sending, and receiving messages over the AMQP 1.0 wire transport protocol to or from AMQ Broker 6 and 7. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. Bugs fixed (https://bugzilla.redhat.com/): 1821315 - CVE-2020-11113 jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime 1831139 - CVE-2020-9488 log4j: improper validation of certificate with host mismatch in SMTP appender 1851327 - CVE-2020-14307 wildfly: EJB SessionOpenInvocations may not be removed properly after a response is received causing Denial of Service 1853595 - CVE-2020-14297 wildfly: Some EJB transaction objects may get accumulated causing Denial of Service 6. JIRA issues fixed (https://issues.jboss.org/): ENTMQCL-1987 - AMQ Resource Adapter example project is incompatible with Maven 3.6 ENTMQCL-1988 - AMQ Resource Adapter example project does not run ENTMQCL-2070 - [jms] Log successful reconnects more prominently 7

Trust: 2.52

sources: NVD: CVE-2020-11113 // JVNDB: JVNDB-2020-003617 // VULHUB: VHN-163659 // VULMON: CVE-2020-11113 // PACKETSTORM: 158650 // PACKETSTORM: 157741 // PACKETSTORM: 160601 // PACKETSTORM: 158651 // PACKETSTORM: 159208 // PACKETSTORM: 158636 // PACKETSTORM: 157322 // PACKETSTORM: 159271

AFFECTED PRODUCTS

vendor:日立model:ucosminexus application serverscope: - version: -

Trust: 1.6

vendor:日立model:ucosminexus service platformscope: - version: -

Trust: 1.6

vendor:oraclemodel:retail xstore point of servicescope:eqversion:17.0

Trust: 1.0

vendor:oraclemodel:banking digital experiencescope:eqversion:18.2

Trust: 1.0

vendor:oraclemodel:communications element managerscope:gteversion:8.2.0

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:8.0

Trust: 1.0

vendor:oraclemodel:jd edwards enterpriseone toolsscope:ltversion:9.2.4.2

Trust: 1.0

vendor:oraclemodel:financial services price creation and discoveryscope:eqversion:8.0.7

Trust: 1.0

vendor:oraclemodel:communications network charging and controlscope:gteversion:12.0.0

Trust: 1.0

vendor:oraclemodel:primavera unifierscope:lteversion:17.12

Trust: 1.0

vendor:oraclemodel:retail xstore point of servicescope:eqversion:16.0

Trust: 1.0

vendor:oraclemodel:agile plmscope:eqversion:9.3.6

Trust: 1.0

vendor:oraclemodel:primavera unifierscope:eqversion:16.2

Trust: 1.0

vendor:oraclemodel:global lifecycle management opatchscope:ltversion:12.2.0.1.20

Trust: 1.0

vendor:oraclemodel:banking platformscope:lteversion:2.9.0

Trust: 1.0

vendor:oraclemodel:financial services institutional performance analyticsscope:eqversion:8.1.0

Trust: 1.0

vendor:oraclemodel:retail service backbonescope:eqversion:15.0

Trust: 1.0

vendor:oraclemodel:weblogic serverscope:eqversion:12.2.1.3.0

Trust: 1.0

vendor:oraclemodel:banking digital experiencescope:eqversion:18.3

Trust: 1.0

vendor:oraclemodel:insurance policy administration j2eescope:eqversion:11.0.2.25

Trust: 1.0

vendor:oraclemodel:autovue for agile product lifecycle managementscope:eqversion:21.0.2

Trust: 1.0

vendor:oraclemodel:financial services retail customer analyticsscope:eqversion:8.0.6

Trust: 1.0

vendor:oraclemodel:communications calendar serverscope:eqversion:8.0.0.4.0

Trust: 1.0

vendor:oraclemodel:enterprise manager base platformscope:eqversion:13.3.0.0

Trust: 1.0

vendor:fasterxmlmodel:jackson-databindscope:ltversion:2.9.10.4

Trust: 1.0

vendor:oraclemodel:communications diameter signaling routerscope:gteversion:8.0.0

Trust: 1.0

vendor:oraclemodel:enterprise manager base platformscope:eqversion:13.4.0.0

Trust: 1.0

vendor:oraclemodel:financial services institutional performance analyticsscope:eqversion:8.0.7

Trust: 1.0

vendor:oraclemodel:communications session report managerscope:gteversion:8.2.0

Trust: 1.0

vendor:oraclemodel:retail service backbonescope:eqversion:14.1

Trust: 1.0

vendor:oraclemodel:retail service backbonescope:eqversion:16.0

Trust: 1.0

vendor:oraclemodel:communications contacts serverscope:eqversion:8.0.0.5.0

Trust: 1.0

vendor:oraclemodel:primavera unifierscope:gteversion:17.7

Trust: 1.0

vendor:oraclemodel:banking digital experiencescope:eqversion:19.2

Trust: 1.0

vendor:oraclemodel:communications session route managerscope:lteversion:8.2.2

Trust: 1.0

vendor:oraclemodel:communications instant messaging serverscope:eqversion:10.0.1.4.0

Trust: 1.0

vendor:oraclemodel:primavera unifierscope:eqversion:16.1

Trust: 1.0

vendor:oraclemodel:financial services price creation and discoveryscope:eqversion:8.0.6

Trust: 1.0

vendor:oraclemodel:communications evolved communications application serverscope:eqversion:7.1

Trust: 1.0

vendor:oraclemodel:webcenter portalscope:eqversion:12.2.1.4.0

Trust: 1.0

vendor:oraclemodel:banking digital experiencescope:eqversion:20.1

Trust: 1.0

vendor:oraclemodel:communications element managerscope:lteversion:8.2.2

Trust: 1.0

vendor:oraclemodel:jd edwards enterpriseone orchestratorscope:ltversion:9.2.4.2

Trust: 1.0

vendor:netappmodel:steelstore cloud integrated storagescope:eqversion: -

Trust: 1.0

vendor:oraclemodel:communications diameter signaling routerscope:lteversion:8.2.2

Trust: 1.0

vendor:oraclemodel:financial services institutional performance analyticsscope:eqversion:8.0.6

Trust: 1.0

vendor:oraclemodel:retail xstore point of servicescope:eqversion:18.0

Trust: 1.0

vendor:fasterxmlmodel:jackson-databindscope:gteversion:2.9.0

Trust: 1.0

vendor:oraclemodel:communications network charging and controlscope:lteversion:12.0.3

Trust: 1.0

vendor:oraclemodel:weblogic serverscope:eqversion:12.2.1.4.0

Trust: 1.0

vendor:oraclemodel:banking platformscope:gteversion:2.4.0

Trust: 1.0

vendor:oraclemodel:financial services analytical applications infrastructurescope:gteversion:8.0.6

Trust: 1.0

vendor:oraclemodel:financial services analytical applications infrastructurescope:lteversion:8.1.0

Trust: 1.0

vendor:oraclemodel:retail merchandising systemscope:eqversion:15.0

Trust: 1.0

vendor:oraclemodel:communications session route managerscope:gteversion:8.2.0

Trust: 1.0

vendor:oraclemodel:banking digital experiencescope:eqversion:19.1

Trust: 1.0

vendor:oraclemodel:primavera unifierscope:eqversion:18.8

Trust: 1.0

vendor:oraclemodel:communications session report managerscope:lteversion:8.2.2

Trust: 1.0

vendor:oraclemodel:retail xstore point of servicescope:eqversion:19.0

Trust: 1.0

vendor:oraclemodel:retail xstore point of servicescope:eqversion:15.0

Trust: 1.0

vendor:oraclemodel:primavera unifierscope:eqversion:19.12

Trust: 1.0

vendor:oraclemodel:webcenter portalscope:eqversion:12.2.1.3.0

Trust: 1.0

vendor:oraclemodel:insurance policy administration j2eescope:eqversion:11.1.0.15

Trust: 1.0

vendor:oraclemodel:banking digital experiencescope:eqversion:18.1

Trust: 1.0

vendor:oraclemodel:retail sales auditscope:eqversion:14.1

Trust: 1.0

vendor:oraclemodel:communications network charging and controlscope:eqversion:6.0.1

Trust: 1.0

vendor:日立model:ucosminexus service architectscope: - version: -

Trust: 0.8

vendor:日立model:ucosminexus application server-rscope: - version: -

Trust: 0.8

vendor:日立model:ucosminexus developerscope: - version: -

Trust: 0.8

vendor:fasterxmlmodel:jackson-databindscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2020-003617 // NVD: CVE-2020-11113

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-11113
value: HIGH

Trust: 1.0

134c704f-9b21-4f2e-91b3-4a467353bcc0: CVE-2020-11113
value: HIGH

Trust: 1.0

NVD: CVE-2020-11113
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202003-1735
value: HIGH

Trust: 0.6

VULHUB: VHN-163659
value: MEDIUM

Trust: 0.1

VULMON: CVE-2020-11113
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-11113
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-163659
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-11113
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 2.0

NVD: CVE-2020-11113
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-163659 // VULMON: CVE-2020-11113 // JVNDB: JVNDB-2020-003617 // CNNVD: CNNVD-202003-1735 // NVD: CVE-2020-11113 // NVD: CVE-2020-11113

PROBLEMTYPE DATA

problemtype:CWE-502

Trust: 1.1

problemtype:Deserialization of untrusted data (CWE-502) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-163659 // JVNDB: JVNDB-2020-003617 // NVD: CVE-2020-11113

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202003-1735

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-202003-1735

PATCH

title:hitachi-sec-2021-109url:https://github.com/FasterXML/jackson-databind/issues/2670

Trust: 0.8

title:FasterXML jackson-databind Fixes for code issue vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=115369

Trust: 0.6

title:Red Hat: Moderate: AMQ Clients 2.8.0 Releaseurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20203817 - Security Advisory

Trust: 0.1

title:Red Hat: Important: rh-maven35-jackson-databind security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20201523 - Security Advisory

Trust: 0.1

title:Red Hat: Moderate: Red Hat Single Sign-On 7.4.0 security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20205625 - Security Advisory

Trust: 0.1

title:Red Hat: Important: Red Hat Data Grid 7.3.7 security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20203779 - Security Advisory

Trust: 0.1

title:Red Hat: Important: Red Hat Decision Manager 7.8.0 Security Updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20203196 - Security Advisory

Trust: 0.1

title:Red Hat: Important: EAP Continuous Delivery Technical Preview Release 19 security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20202333 - Security Advisory

Trust: 0.1

title:Red Hat: Important: Red Hat Process Automation Manager 7.8.0 Security Updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20203197 - Security Advisory

Trust: 0.1

title:Red Hat: Important: Red Hat build of Thorntail 2.5.1 security and bug fix updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20202067 - Security Advisory

Trust: 0.1

title:Red Hat: Important: Red Hat Fuse 7.7.0 release and security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20203192 - Security Advisory

Trust: 0.1

title:Hitachi Security Advisories: Multiple Vulnerabilities in Cosminexusurl:https://vulmon.com/vendoradvisory?qidtp=hitachi_security_advisories&qid=hitachi-sec-2021-109

Trust: 0.1

title:CVE-2020-11113url:https://github.com/Al1ex/CVE-2020-11113

Trust: 0.1

title:Cubedurl:https://github.com/yahoo/cubed

Trust: 0.1

title:Java-Deserialization-CVEsurl:https://github.com/PalindromeLabs/Java-Deserialization-CVEs

Trust: 0.1

title:PoC in GitHuburl:https://github.com/soosmile/POC

Trust: 0.1

title:PoC in GitHuburl:https://github.com/developer3000S/PoC-in-GitHub

Trust: 0.1

title:PoC in GitHuburl:https://github.com/hectorgie/PoC-in-GitHub

Trust: 0.1

title:PoC in GitHuburl:https://github.com/0xT11/CVE-POC

Trust: 0.1

sources: VULMON: CVE-2020-11113 // JVNDB: JVNDB-2020-003617 // CNNVD: CNNVD-202003-1735

EXTERNAL IDS

db:NVDid:CVE-2020-11113

Trust: 4.2

db:PACKETSTORMid:159208

Trust: 0.8

db:PACKETSTORMid:158651

Trust: 0.8

db:PACKETSTORMid:160601

Trust: 0.8

db:PACKETSTORMid:159271

Trust: 0.8

db:JVNid:JVNVU95897514

Trust: 0.8

db:JVNDBid:JVNDB-2020-003617

Trust: 0.8

db:CNNVDid:CNNVD-202003-1735

Trust: 0.7

db:PACKETSTORMid:157322

Trust: 0.7

db:AUSCERTid:ESB-2020.1399

Trust: 0.6

db:AUSCERTid:ESB-2020.1766

Trust: 0.6

db:AUSCERTid:ESB-2020.2588

Trust: 0.6

db:AUSCERTid:ESB-2020.4471

Trust: 0.6

db:AUSCERTid:ESB-2020.3190

Trust: 0.6

db:AUSCERTid:ESB-2020.1368

Trust: 0.6

db:AUSCERTid:ESB-2020.1882

Trust: 0.6

db:AUSCERTid:ESB-2020.2619

Trust: 0.6

db:AUSCERTid:ESB-2020.3258

Trust: 0.6

db:CS-HELPid:SB2022060909

Trust: 0.6

db:NSFOCUSid:48047

Trust: 0.6

db:PACKETSTORMid:158650

Trust: 0.2

db:CNVDid:CNVD-2020-21476

Trust: 0.1

db:VULHUBid:VHN-163659

Trust: 0.1

db:VULMONid:CVE-2020-11113

Trust: 0.1

db:PACKETSTORMid:157741

Trust: 0.1

db:PACKETSTORMid:158636

Trust: 0.1

sources: VULHUB: VHN-163659 // VULMON: CVE-2020-11113 // JVNDB: JVNDB-2020-003617 // PACKETSTORM: 158650 // PACKETSTORM: 157741 // PACKETSTORM: 160601 // PACKETSTORM: 158651 // PACKETSTORM: 159208 // PACKETSTORM: 158636 // PACKETSTORM: 157322 // PACKETSTORM: 159271 // CNNVD: CNNVD-202003-1735 // NVD: CVE-2020-11113

REFERENCES

url:https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html

Trust: 2.6

url:https://nvd.nist.gov/vuln/detail/cve-2020-11113

Trust: 2.0

url:https://security.netapp.com/advisory/ntap-20200403-0002/

Trust: 1.8

url:https://github.com/fasterxml/jackson-databind/issues/2670

Trust: 1.8

url:https://www.oracle.com/security-alerts/cpujan2021.html

Trust: 1.8

url:https://www.oracle.com/security-alerts/cpujul2020.html

Trust: 1.8

url:https://www.oracle.com/security-alerts/cpuoct2020.html

Trust: 1.8

url:https://www.oracle.com/security-alerts/cpuoct2021.html

Trust: 1.8

url:https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062

Trust: 1.1

url:https://jvn.jp/vu/jvnvu95897514/index.html

Trust: 0.8

url:https://access.redhat.com/security/cve/cve-2020-11113

Trust: 0.8

url:https://access.redhat.com/security/team/contact/

Trust: 0.8

url:https://www.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.8

url:https://bugzilla.redhat.com/):

Trust: 0.8

url:https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062

Trust: 0.7

url:https://access.redhat.com/security/cve/cve-2020-11112

Trust: 0.7

url:https://access.redhat.com/security/cve/cve-2020-10968

Trust: 0.7

url:https://access.redhat.com/security/cve/cve-2020-11111

Trust: 0.7

url:https://access.redhat.com/security/updates/classification/#important

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2020-11619

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2020-10969

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2020-11620

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.1368/

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022060909

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-series-of-vulnerabilities-in-fasterxml-jackson-databind-affect-apache-solr-shipped-with-ibm-operations-analytics-log-analysis/

Trust: 0.6

url:https://packetstormsecurity.com/files/159271/red-hat-security-advisory-2020-3817-01.html

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-jackson-databind-shipped-with-ibm-cloud-pak-system/

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cognos-business-intelligence-has-addressed-multiple-vulnerabilities-q12021/

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.2588/

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cognos-analytics-has-addressed-multiple-vulnerabilities-3/

Trust: 0.6

url:https://www.ibm.com/support/pages/node/6525182

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-faster-xml-jackson-databind-affect-ibm-spectrum-protect-plus-cve-2020-10673-cve-2020-1112-cve-2020-11113-cve-2020-10672-cve-2020-10968-cve-2020-10969-cve-2/

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.2619/

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.3258/

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.1766/

Trust: 0.6

url:http://www.nsfocus.net/vulndb/48047

Trust: 0.6

url:https://packetstormsecurity.com/files/157322/red-hat-security-advisory-2020-1523-01.html

Trust: 0.6

url:https://packetstormsecurity.com/files/160601/red-hat-security-advisory-2020-5625-01.html

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.1882/

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.4471/

Trust: 0.6

url:https://packetstormsecurity.com/files/158651/red-hat-security-advisory-2020-3197-01.html

Trust: 0.6

url:https://vigilance.fr/vulnerability/fasterxml-jackson-databind-denial-of-service-via-openjpa-wasregistrymanagedruntime-serialization-gadgets-typing-32065

Trust: 0.6

url:https://packetstormsecurity.com/files/159208/red-hat-security-advisory-2020-3779-01.html

Trust: 0.6

url:https://www.ibm.com/support/pages/node/6528214

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnerabilities-in-jackson-databind-affect-ibm-sterling-b2b-integrator-3/

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.3190/

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-affects-ibm-jazz-foundation-and-ibm-engineering-products/

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.1399/

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2020-9547

Trust: 0.5

url:https://access.redhat.com/security/cve/cve-2020-9546

Trust: 0.5

url:https://access.redhat.com/security/cve/cve-2020-10672

Trust: 0.5

url:https://access.redhat.com/security/cve/cve-2020-10673

Trust: 0.5

url:https://access.redhat.com/security/cve/cve-2020-9548

Trust: 0.5

url:https://access.redhat.com/security/cve/cve-2020-8840

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2020-11111

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2020-11112

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2020-10968

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2020-11620

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2019-20330

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2020-10672

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2020-11619

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2019-20330

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2020-7238

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2020-10969

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2019-12406

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2019-9514

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2019-17573

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2019-20444

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2020-14060

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2019-9512

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2019-12406

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2019-17573

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2020-11612

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2019-9514

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2019-9515

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2020-14061

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2019-20445

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2019-20444

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2020-14062

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2019-9512

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2020-11612

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2019-20445

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2020-10673

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2019-10086

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2019-10086

Trust: 0.3

url:https://access.redhat.com/errata/rhsa-2020:3817

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-14060

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-1718

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-9515

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-13990

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2020-1718

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-9518

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-13990

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-16869

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-12423

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-16869

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-12423

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-9518

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-14061

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-14062

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-16335

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-16943

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-9511

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-12400

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-17531

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-16335

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-17531

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-14540

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-17267

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-9511

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-16942

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-14892

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-16943

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-17267

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-14893

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-16942

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-14893

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-14888

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-12400

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-14892

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-14540

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-14888

Trust: 0.2

url:https://access.redhat.com/security/updates/classification/#moderate

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-10172

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2020-9488

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-9488

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-10172

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2020-1757

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2020-1745

Trust: 0.2

url:https://access.redhat.com/security/team/key/

Trust: 0.2

url:https://access.redhat.com/articles/11258

Trust: 0.2

url:https://cwe.mitre.org/data/definitions/502.html

Trust: 0.1

url:https://github.com/al1ex/cve-2020-11113

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hitachi-sec-2021-109/index.html

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2020:3196

Trust: 0.1

url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions&product=rhdm&version=7.8.0

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-7238

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_decision_manager/7.8/html/release_notes_for_red_hat_decision_manager_7.8/index

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-3875

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-14832

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-10201

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_build_of_thorntail/2.5/html/release_notes_for_thorntail_2.5/

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2020:2067

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-3875

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-14838

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-0210

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-0205

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-12419

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-0210

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-10219

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-14832

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-10199

Trust: 0.1

url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions&product=catrhoar.thorntail&version=2.5.1

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-14887

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-10201

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-1729

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-12419

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-0205

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-10199

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-14838

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-10219

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-14887

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-14820

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-14820

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-1727

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-1727

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2020:5625

Trust: 0.1

url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=core.service.rhsso&downloadtype=distributions&version=7.4

Trust: 0.1

url:https://access.redhat.com/errata/rhba-2020:1414

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_process_automation_manager/7.8/html/release_notes_for_red_hat_process_automation_manager_7.8/index

Trust: 0.1

url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions&product=rhpam&version=7.8.0

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2020:3197

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-1719

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-1710

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-1695

Trust: 0.1

url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product\xdata.grid&downloadtype=securitypatches&version=7.3

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-9547

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-1745

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2020:3779

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-1719

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-10714

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-1757

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-1695

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-10714

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-9548

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_data_grid/7.3/html/red_hat_data_grid_7.3_release_notes/index

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-8840

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-9546

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2017-7658

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-1710

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-1748

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2017-7658

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-1748

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-11797

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-12086

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2018-1000632

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-1000632

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2018-3831

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-0231

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2018-11797

Trust: 0.1

url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions&product=jboss.fuse&version=7.7.0

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2018-12541

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-3797

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2016-4970

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-9827

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_fuse/7.7/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-12086

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-4970

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-1953

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-0231

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9827

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-3831

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-12541

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2020:3192

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-14195

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-3797

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2020:1523

Trust: 0.1

url:https://issues.jboss.org/):

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-14307

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_amq

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-14307

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-14297

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-14297

Trust: 0.1

sources: VULHUB: VHN-163659 // VULMON: CVE-2020-11113 // JVNDB: JVNDB-2020-003617 // PACKETSTORM: 158650 // PACKETSTORM: 157741 // PACKETSTORM: 160601 // PACKETSTORM: 158651 // PACKETSTORM: 159208 // PACKETSTORM: 158636 // PACKETSTORM: 157322 // PACKETSTORM: 159271 // CNNVD: CNNVD-202003-1735 // NVD: CVE-2020-11113

CREDITS

Red Hat

Trust: 1.4

sources: PACKETSTORM: 158650 // PACKETSTORM: 157741 // PACKETSTORM: 160601 // PACKETSTORM: 158651 // PACKETSTORM: 159208 // PACKETSTORM: 158636 // PACKETSTORM: 157322 // PACKETSTORM: 159271 // CNNVD: CNNVD-202003-1735

SOURCES

db:VULHUBid:VHN-163659
db:VULMONid:CVE-2020-11113
db:JVNDBid:JVNDB-2020-003617
db:PACKETSTORMid:158650
db:PACKETSTORMid:157741
db:PACKETSTORMid:160601
db:PACKETSTORMid:158651
db:PACKETSTORMid:159208
db:PACKETSTORMid:158636
db:PACKETSTORMid:157322
db:PACKETSTORMid:159271
db:CNNVDid:CNNVD-202003-1735
db:NVDid:CVE-2020-11113

LAST UPDATE DATE

2024-11-07T20:46:11.309000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-163659date:2021-12-10T00:00:00
db:VULMONid:CVE-2020-11113date:2023-11-07T00:00:00
db:JVNDBid:JVNDB-2020-003617date:2024-07-22T06:03:00
db:CNNVDid:CNNVD-202003-1735date:2022-06-10T00:00:00
db:NVDid:CVE-2020-11113date:2024-07-03T01:36:12.463

SOURCES RELEASE DATE

db:VULHUBid:VHN-163659date:2020-03-31T00:00:00
db:VULMONid:CVE-2020-11113date:2020-03-31T00:00:00
db:JVNDBid:JVNDB-2020-003617date:2020-04-21T00:00:00
db:PACKETSTORMid:158650date:2020-07-29T17:52:58
db:PACKETSTORMid:157741date:2020-05-18T16:42:53
db:PACKETSTORMid:160601date:2020-12-17T18:09:37
db:PACKETSTORMid:158651date:2020-07-29T17:53:05
db:PACKETSTORMid:159208date:2020-09-17T14:07:40
db:PACKETSTORMid:158636date:2020-07-29T00:05:59
db:PACKETSTORMid:157322date:2020-04-21T14:19:58
db:PACKETSTORMid:159271date:2020-09-23T14:57:38
db:CNNVDid:CNNVD-202003-1735date:2020-03-31T00:00:00
db:NVDid:CVE-2020-11113date:2020-03-31T05:15:13.117