ID

VAR-202006-1826


CVE

CVE-2020-14060


TITLE

FasterXML jackson-databind Unreliable data deserialization vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2020-006822

DESCRIPTION

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill). FasterXML jackson-databind Exists in an unreliable data deserialization vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. FasterXML Jackson is a data processing tool for Java developed by American FasterXML Company. jackson-databind is one of the components with data binding function. A security vulnerability exists in FasterXML jackson-databind 2.x versions prior to 2.9.10.5. Currently there is no information about this vulnerability, please keep an eye on CNNVD or vendor announcements. Description: Red Hat Decision Manager is an open source decision management platform that combines business rules management, complex event processing, Decision Model & Notation (DMN) execution, and Business Optimizer for solving planning problems. It automates business decisions and makes that logic available to the entire business. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process. The References section of this erratum contains a download link (you must log in to download the update). -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat Fuse 7.7.0 release and security update Advisory ID: RHSA-2020:3192-01 Product: Red Hat JBoss Fuse Advisory URL: https://access.redhat.com/errata/RHSA-2020:3192 Issue date: 2020-07-28 CVE Names: CVE-2016-4970 CVE-2018-3831 CVE-2018-11797 CVE-2018-12541 CVE-2018-1000632 CVE-2019-0231 CVE-2019-3797 CVE-2019-9511 CVE-2019-9827 CVE-2019-10086 CVE-2019-10172 CVE-2019-12086 CVE-2019-12400 CVE-2019-14540 CVE-2019-14888 CVE-2019-14892 CVE-2019-14893 CVE-2019-16335 CVE-2019-16942 CVE-2019-16943 CVE-2019-17267 CVE-2019-17531 CVE-2019-17573 CVE-2019-20330 CVE-2019-20444 CVE-2019-20445 CVE-2020-1745 CVE-2020-1757 CVE-2020-1953 CVE-2020-7238 CVE-2020-8840 CVE-2020-9546 CVE-2020-9547 CVE-2020-9548 CVE-2020-10672 CVE-2020-10673 CVE-2020-10968 CVE-2020-10969 CVE-2020-11111 CVE-2020-11112 CVE-2020-11113 CVE-2020-11619 CVE-2020-11620 CVE-2020-14060 CVE-2020-14061 CVE-2020-14062 CVE-2020-14195 ==================================================================== 1. Summary: A minor version update (from 7.6 to 7.7) is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: This release of Red Hat Fuse 7.7.0 serves as a replacement for Red Hat Fuse 7.6, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix(es): * netty (CVE-2016-4970 CVE-2020-7238 CVE-2019-20444 CVE-2019-20445) * dom4j (CVE-2018-1000632) * elasticsearch (CVE-2018-3831) * pdfbox (CVE-2018-11797) * vertx (CVE-2018-12541) * spring-data-jpa (CVE-2019-3797) * mina-core (CVE-2019-0231) * jackson-databind (CVE-2019-12086 CVE-2019-16335 CVE-2019-14540 CVE-2019-17267 CVE-2019-14892 CVE-2019-14893 CVE-2019-16942 CVE-2019-16943 CVE-2019-17531 CVE-2019-20330 CVE-2020-10673 CVE-2020-10672 CVE-2020-8840 CVE-2020-9546 CVE-2020-9547 CVE-2020-9548 CVE-2020-10968 CVE-2020-10969 CVE-2020-11111 CVE-2020-11112 CVE-2020-11113 CVE-2020-11620 CVE-2020-11619 CVE-2020-14195 CVE-2020-14060 CVE-2020-14061 CVE-2020-14062) * jackson-mapper-asl (CVE-2019-10172) * hawtio (CVE-2019-9827) * undertow (CVE-2019-9511 CVE-2020-1757 CVE-2019-14888 CVE-2020-1745) * santuario (CVE-2019-12400) * apache-commons-beanutils (CVE-2019-10086) * cxf (CVE-2019-17573) * apache-commons-configuration (CVE-2020-1953) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Installation instructions are available from the Fuse 7.7.0 product documentation page: https://access.redhat.com/documentation/en-us/red_hat_fuse/7.7/ 4. Bugs fixed (https://bugzilla.redhat.com/): 1343616 - CVE-2016-4970 netty: Infinite loop vulnerability when handling renegotiation using SslProvider.OpenSsl 1620529 - CVE-2018-1000632 dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents 1632452 - CVE-2018-3831 elasticsearch: Information exposure via _cluster/settings API 1637492 - CVE-2018-11797 pdfbox: unbounded computation in parser resulting in a denial of service 1638391 - CVE-2018-12541 vertx: WebSocket HTTP upgrade implementation holds the entire http request in memory before the handshake 1697598 - CVE-2019-3797 spring-data-jpa: Additional information exposure with Spring Data JPA derived queries 1700016 - CVE-2019-0231 mina-core: Retaining an open socket in close_notify SSL-TLS leading to Information disclosure. 1713468 - CVE-2019-12086 jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server. 1715075 - CVE-2019-10172 jackson-mapper-asl: XML external entity similar to CVE-2016-3720 1728604 - CVE-2019-9827 hawtio: server side request forgery via initial /proxy/ substring of a URI 1741860 - CVE-2019-9511 HTTP/2: large amount of data requests leads to denial of service 1752770 - CVE-2020-1757 undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass 1755831 - CVE-2019-16335 jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource 1755849 - CVE-2019-14540 jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig 1758167 - CVE-2019-17267 jackson-databind: Serialization gadgets in classes of the ehcache package 1758171 - CVE-2019-14892 jackson-databind: Serialization gadgets in classes of the commons-configuration package 1758182 - CVE-2019-14893 jackson-databind: Serialization gadgets in classes of the xalan package 1758187 - CVE-2019-16942 jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.* 1758191 - CVE-2019-16943 jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource 1764658 - CVE-2019-12400 xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source 1767483 - CVE-2019-10086 apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default 1772464 - CVE-2019-14888 undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS 1775293 - CVE-2019-17531 jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.* 1793154 - CVE-2019-20330 jackson-databind: lacks certain net.sf.ehcache blocking 1796225 - CVE-2020-7238 netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling 1797011 - CVE-2019-17573 cxf: reflected XSS in the services listing page 1798509 - CVE-2019-20445 netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header 1798524 - CVE-2019-20444 netty: HTTP request smuggling 1807305 - CVE-2020-1745 undertow: AJP File Read/Inclusion Vulnerability 1815212 - CVE-2020-1953 apache-commons-configuration: uncontrolled class instantiation when loading YAML files 1815470 - CVE-2020-10673 jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution 1815495 - CVE-2020-10672 jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution 1816330 - CVE-2020-8840 jackson-databind: Lacks certain xbean-reflect/JNDI blocking 1816332 - CVE-2020-9546 jackson-databind: Serialization gadgets in shaded-hikari-config 1816337 - CVE-2020-9547 jackson-databind: Serialization gadgets in ibatis-sqlmap 1816340 - CVE-2020-9548 jackson-databind: Serialization gadgets in anteros-core 1819208 - CVE-2020-10968 jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider 1819212 - CVE-2020-10969 jackson-databind: Serialization gadgets in javax.swing.JEditorPane 1821304 - CVE-2020-11111 jackson-databind: Serialization gadgets in org.apache.activemq.jms.pool.XaPooledConnectionFactory 1821311 - CVE-2020-11112 jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider 1821315 - CVE-2020-11113 jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime 1826798 - CVE-2020-11620 jackson-databind: Serialization gadgets in commons-jelly:commons-jelly 1826805 - CVE-2020-11619 jackson-databind: Serialization gadgets in org.springframework:spring-aop 1848958 - CVE-2020-14195 jackson-databind: serialization in org.jsecurity.realm.jndi.JndiRealmFactory 1848960 - CVE-2020-14060 jackson-databind: serialization in oadd.org.apache.xalan.lib.sql.JNDIConnectionPool 1848962 - CVE-2020-14062 jackson-databind: serialization in com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool 1848966 - CVE-2020-14061 jackson-databind: serialization in weblogic/oracle-aqjms 5. References: https://access.redhat.com/security/cve/CVE-2016-4970 https://access.redhat.com/security/cve/CVE-2018-3831 https://access.redhat.com/security/cve/CVE-2018-11797 https://access.redhat.com/security/cve/CVE-2018-12541 https://access.redhat.com/security/cve/CVE-2018-1000632 https://access.redhat.com/security/cve/CVE-2019-0231 https://access.redhat.com/security/cve/CVE-2019-3797 https://access.redhat.com/security/cve/CVE-2019-9511 https://access.redhat.com/security/cve/CVE-2019-9827 https://access.redhat.com/security/cve/CVE-2019-10086 https://access.redhat.com/security/cve/CVE-2019-10172 https://access.redhat.com/security/cve/CVE-2019-12086 https://access.redhat.com/security/cve/CVE-2019-12400 https://access.redhat.com/security/cve/CVE-2019-14540 https://access.redhat.com/security/cve/CVE-2019-14888 https://access.redhat.com/security/cve/CVE-2019-14892 https://access.redhat.com/security/cve/CVE-2019-14893 https://access.redhat.com/security/cve/CVE-2019-16335 https://access.redhat.com/security/cve/CVE-2019-16942 https://access.redhat.com/security/cve/CVE-2019-16943 https://access.redhat.com/security/cve/CVE-2019-17267 https://access.redhat.com/security/cve/CVE-2019-17531 https://access.redhat.com/security/cve/CVE-2019-17573 https://access.redhat.com/security/cve/CVE-2019-20330 https://access.redhat.com/security/cve/CVE-2019-20444 https://access.redhat.com/security/cve/CVE-2019-20445 https://access.redhat.com/security/cve/CVE-2020-1745 https://access.redhat.com/security/cve/CVE-2020-1757 https://access.redhat.com/security/cve/CVE-2020-1953 https://access.redhat.com/security/cve/CVE-2020-7238 https://access.redhat.com/security/cve/CVE-2020-8840 https://access.redhat.com/security/cve/CVE-2020-9546 https://access.redhat.com/security/cve/CVE-2020-9547 https://access.redhat.com/security/cve/CVE-2020-9548 https://access.redhat.com/security/cve/CVE-2020-10672 https://access.redhat.com/security/cve/CVE-2020-10673 https://access.redhat.com/security/cve/CVE-2020-10968 https://access.redhat.com/security/cve/CVE-2020-10969 https://access.redhat.com/security/cve/CVE-2020-11111 https://access.redhat.com/security/cve/CVE-2020-11112 https://access.redhat.com/security/cve/CVE-2020-11113 https://access.redhat.com/security/cve/CVE-2020-11619 https://access.redhat.com/security/cve/CVE-2020-11620 https://access.redhat.com/security/cve/CVE-2020-14060 https://access.redhat.com/security/cve/CVE-2020-14061 https://access.redhat.com/security/cve/CVE-2020-14062 https://access.redhat.com/security/cve/CVE-2020-14195 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.fuse&version=7.7.0 https://access.redhat.com/documentation/en-us/red_hat_fuse/7.7/ 6. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXyBKZtzjgjWX9erEAQi36A//TAru3rmOqPcxv1hTEGyaF3hRH4jrvn/T xRMxfu2yfExW5bRSr6GH0+YMpRkdmGVpuZtDwGoQYKIaA7dJ9XyPpBLtszfOe1pu eVoNUrEvy53KnfzxEMrA0cYPpBwXmjd52QH3xaBL0ZqoHPciM8ZuoatCL9YcCUQb mdbPLBTfn9YQL7D993E3gcG2kfgO8hEJrlDXXbMxUCuD1hJ4k2g8uvuz0IPwunQC KSe4baOZUmvUheimDzybBIdSUBlNp/OuO9NshSCOwgfYUh3Sln0HEDuUWX3MzlfF 7fDdMAl98ULF0NcElL4MHUVxcaYpwGedAkODkI9s+XXDYvi9Nuhywla2zZ48l+5t ZkN0Wlq2OE24ELjd6xE9EfCdkfABz/sOqlr3tAaH5JBXtVhgC1e15psXqVAxIR+J ePzvbYFsZXtX8klx3QF4PHh1jRILOUOy5DHZV7aSRB3bj+g4ICB96N7M4m4Qcepm s09Qn2F0DngSOvwPnO2Cltl1K07wiG2q7Y5s3INoIFQFrB88RQw6cgJWDPH5OVZ0 N7LpgYANPzL5rkvoZybTVM8oBAGfVSrIGeHq35icuivXyz/M4DAa8bVaCvReP3ai MGUG/y0fczE2ajNlHcjQJHETbIctedeIb6ojHuBvs3g6219wrqMskkZURSUtC0Tv wFoh8mUDRG4=5qqZ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Trust: 2.07

sources: NVD: CVE-2020-14060 // JVNDB: JVNDB-2020-006822 // VULHUB: VHN-166901 // VULMON: CVE-2020-14060 // PACKETSTORM: 158650 // PACKETSTORM: 158651 // PACKETSTORM: 158636

AFFECTED PRODUCTS

vendor:oraclemodel:banking digital experiencescope:eqversion:18.2

Trust: 1.0

vendor:oraclemodel:communications element managerscope:gteversion:8.2.0

Trust: 1.0

vendor:oraclemodel:banking digital experiencescope:eqversion:20.1

Trust: 1.0

vendor:oraclemodel:communications element managerscope:lteversion:8.2.2

Trust: 1.0

vendor:oraclemodel:agile plmscope:eqversion:9.3.6

Trust: 1.0

vendor:netappmodel:steelstore cloud integrated storagescope:eqversion: -

Trust: 1.0

vendor:oraclemodel:communications diameter signaling routerscope:lteversion:8.2.2

Trust: 1.0

vendor:oraclemodel:communications session route managerscope:lteversion:8.2.2

Trust: 1.0

vendor:oraclemodel:banking digital experiencescope:eqversion:18.3

Trust: 1.0

vendor:fasterxmlmodel:jackson-databindscope:gteversion:2.9.0

Trust: 1.0

vendor:oraclemodel:communications calendar serverscope:eqversion:8.0.0.4.0

Trust: 1.0

vendor:oraclemodel:communications diameter signaling routerscope:gteversion:8.0.0

Trust: 1.0

vendor:oraclemodel:communications session report managerscope:gteversion:8.2.0

Trust: 1.0

vendor:oraclemodel:banking digital experiencescope:eqversion:19.1

Trust: 1.0

vendor:oraclemodel:communications session route managerscope:gteversion:8.2.0

Trust: 1.0

vendor:oraclemodel:communications session report managerscope:lteversion:8.2.2

Trust: 1.0

vendor:netappmodel:active iq unified managerscope:gteversion:9.5

Trust: 1.0

vendor:oraclemodel:communications contacts serverscope:eqversion:8.0.0.5.0

Trust: 1.0

vendor:fasterxmlmodel:jackson-databindscope:ltversion:2.9.10.5

Trust: 1.0

vendor:oraclemodel:banking digital experiencescope:eqversion:19.2

Trust: 1.0

vendor:netappmodel:active iq unified managerscope:gteversion:7.3

Trust: 1.0

vendor:oraclemodel:banking digital experiencescope:eqversion:18.1

Trust: 1.0

vendor:oraclemodel:communications evolved communications application serverscope:eqversion:7.1

Trust: 1.0

vendor:fasterxmlmodel:jackson-databindscope:eqversion:2.9.10.5

Trust: 0.8

vendor:hitachimodel:ops center common servicesscope:eqversion:(海外販売のみ)

Trust: 0.8

sources: JVNDB: JVNDB-2020-006822 // NVD: CVE-2020-14060

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-14060
value: HIGH

Trust: 1.0

NVD: JVNDB-2020-006822
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202006-997
value: HIGH

Trust: 0.6

VULHUB: VHN-166901
value: MEDIUM

Trust: 0.1

VULMON: CVE-2020-14060
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-14060
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

NVD: JVNDB-2020-006822
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

VULHUB: VHN-166901
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-14060
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.2
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: JVNDB-2020-006822
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-166901 // VULMON: CVE-2020-14060 // JVNDB: JVNDB-2020-006822 // CNNVD: CNNVD-202006-997 // NVD: CVE-2020-14060

PROBLEMTYPE DATA

problemtype:CWE-502

Trust: 1.9

sources: VULHUB: VHN-166901 // JVNDB: JVNDB-2020-006822 // NVD: CVE-2020-14060

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202006-997

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-202006-997

CONFIGURATIONS

sources: JVNDB: JVNDB-2020-006822

PATCH

title:Block one more gadget type (apache-drill, CVE-2020-14060) #2688url:https://github.com/FasterXML/jackson-databind/issues/2688

Trust: 0.8

title:hitachi-sec-2020-125url:http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2020-125/index.html

Trust: 0.8

title:hitachi-sec-2020-125url:https://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2020-125/index.html

Trust: 0.8

title:FasterXML jackson-databind Fixes for code issue vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=122483

Trust: 0.6

title:Red Hat: Important: Red Hat Decision Manager 7.8.0 Security Updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20203196 - Security Advisory

Trust: 0.1

title:Red Hat: Important: Red Hat Process Automation Manager 7.8.0 Security Updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20203197 - Security Advisory

Trust: 0.1

title:Hitachi Security Advisories: Multiple Vulnerabilities in Hitachi Ops Center Common Servicesurl:https://vulmon.com/vendoradvisory?qidtp=hitachi_security_advisories&qid=hitachi-sec-2020-125

Trust: 0.1

title:Red Hat: Important: Red Hat Fuse 7.7.0 release and security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20203192 - Security Advisory

Trust: 0.1

title:Hitachi Security Advisories: Multiple Vulnerabilities in Cosminexusurl:https://vulmon.com/vendoradvisory?qidtp=hitachi_security_advisories&qid=hitachi-sec-2021-109

Trust: 0.1

title:Cubedurl:https://github.com/yahoo/cubed

Trust: 0.1

title:SecBooks SecBooks目录url:https://github.com/SexyBeast233/SecBooks

Trust: 0.1

sources: VULMON: CVE-2020-14060 // JVNDB: JVNDB-2020-006822 // CNNVD: CNNVD-202006-997

EXTERNAL IDS

db:NVDid:CVE-2020-14060

Trust: 2.9

db:PACKETSTORMid:158651

Trust: 0.8

db:JVNDBid:JVNDB-2020-006822

Trust: 0.8

db:CNNVDid:CNNVD-202006-997

Trust: 0.7

db:AUSCERTid:ESB-2020.2280

Trust: 0.6

db:AUSCERTid:ESB-2020.2588

Trust: 0.6

db:AUSCERTid:ESB-2020.2619

Trust: 0.6

db:CS-HELPid:SB2022060909

Trust: 0.6

db:NSFOCUSid:48649

Trust: 0.6

db:PACKETSTORMid:158650

Trust: 0.2

db:VULHUBid:VHN-166901

Trust: 0.1

db:VULMONid:CVE-2020-14060

Trust: 0.1

db:PACKETSTORMid:158636

Trust: 0.1

sources: VULHUB: VHN-166901 // VULMON: CVE-2020-14060 // JVNDB: JVNDB-2020-006822 // PACKETSTORM: 158650 // PACKETSTORM: 158651 // PACKETSTORM: 158636 // CNNVD: CNNVD-202006-997 // NVD: CVE-2020-14060

REFERENCES

url:https://security.netapp.com/advisory/ntap-20200702-0003/

Trust: 1.8

url:https://github.com/fasterxml/jackson-databind/issues/2688

Trust: 1.8

url:https://www.oracle.com//security-alerts/cpujul2021.html

Trust: 1.8

url:https://www.oracle.com/security-alerts/cpuapr2021.html

Trust: 1.8

url:https://www.oracle.com/security-alerts/cpujan2021.html

Trust: 1.8

url:https://www.oracle.com/security-alerts/cpuoct2020.html

Trust: 1.8

url:https://www.oracle.com/security-alerts/cpuoct2021.html

Trust: 1.8

url:https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2020-14060

Trust: 1.6

url:https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062

Trust: 1.1

url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-14060

Trust: 0.8

url:https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062

Trust: 0.7

url:https://www.cybersecurity-help.cz/vdb/sb2022060909

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-series-of-vulnerabilities-in-fasterxml-jackson-databind-affect-apache-solr-shipped-with-ibm-operations-analytics-log-analysis/

Trust: 0.6

url:http://www.nsfocus.net/vulndb/48649

Trust: 0.6

url:https://packetstormsecurity.com/files/158651/red-hat-security-advisory-2020-3197-01.html

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.2280/

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-faster-xml-jackson-databind-affects-ibm-operations-analytics-predictive-insights-cve-2019-14060-cve-2019-14661-cve-2019-14662/

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-jackson-databind-shipped-with-ibm-cloud-pak-system/

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cognos-business-intelligence-has-addressed-multiple-vulnerabilities-q12021/

Trust: 0.6

url:https://www.ibm.com/support/pages/node/6528214

Trust: 0.6

url:https://vigilance.fr/vulnerability/fasterxml-jackson-databind-code-execution-via-apache-drill-32685

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.2588/

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-jquery-spring-dom4j-mongodb-linux-kernel-targetcli-fb-jackson-node-js-and-apache-commons-affect-ibm-spectrum-protect-plus/

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cognos-analytics-has-addressed-multiple-vulnerabilities-3/

Trust: 0.6

url:https://www.ibm.com/support/pages/node/6525182

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.2619/

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2020-11112

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2020-9547

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2020-11113

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2020-10968

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2019-17573

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2019-20444

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2020-9546

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2020-14060

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2020-10672

Trust: 0.3

url:https://access.redhat.com/security/updates/classification/#important

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2019-17573

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2019-20330

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2020-14061

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2020-11619

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2019-20445

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2020-10673

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2020-9548

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2019-20444

Trust: 0.3

url:https://access.redhat.com/security/team/contact/

Trust: 0.3

url:https://www.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2020-14062

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2020-8840

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2020-10672

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2020-10969

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2020-11620

Trust: 0.3

url:https://bugzilla.redhat.com/):

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2019-20330

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2020-7238

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2020-11111

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2019-20445

Trust: 0.3

url:https://access.redhat.com/errata/rhsa-2020:3196

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-12406

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-9514

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-1718

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-9515

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-13990

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-11620

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-9512

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-12406

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-11612

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-9514

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-9515

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2020-1718

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-9518

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-13990

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-16869

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-11619

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-11111

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-9512

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-12423

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-11112

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2020-11612

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-16869

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-12423

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-10968

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-9518

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-10969

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-14061

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-11113

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-14062

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-10673

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-10086

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-10086

Trust: 0.2

url:https://cwe.mitre.org/data/definitions/502.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://github.com/yahoo/cubed

Trust: 0.1

url:https://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hitachi-sec-2020-125/index.html

Trust: 0.1

url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions&product=rhdm&version=7.8.0

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-7238

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_decision_manager/7.8/html/release_notes_for_red_hat_decision_manager_7.8/index

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_process_automation_manager/7.8/html/release_notes_for_red_hat_process_automation_manager_7.8/index

Trust: 0.1

url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions&product=rhpam&version=7.8.0

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2020:3197

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-16335

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-11797

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-16943

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-10172

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-12086

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2018-1000632

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-1000632

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9511

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-12400

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2018-3831

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-0231

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2018-11797

Trust: 0.1

url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions&product=jboss.fuse&version=7.7.0

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-17531

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-16335

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2018-12541

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-3797

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2016-4970

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-17531

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-9827

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-14540

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-17267

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-1745

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_fuse/7.7/

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-9511

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-10172

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-12086

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-16942

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-14892

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-4970

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-1953

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-1757

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-16943

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-0231

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-17267

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-14893

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9827

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-16942

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-14893

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-3831

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-14888

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-12400

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-14892

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-12541

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-14540

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2020:3192

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-14195

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-3797

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-14888

Trust: 0.1

sources: VULHUB: VHN-166901 // VULMON: CVE-2020-14060 // JVNDB: JVNDB-2020-006822 // PACKETSTORM: 158650 // PACKETSTORM: 158651 // PACKETSTORM: 158636 // CNNVD: CNNVD-202006-997 // NVD: CVE-2020-14060

CREDITS

Red Hat

Trust: 0.9

sources: PACKETSTORM: 158650 // PACKETSTORM: 158651 // PACKETSTORM: 158636 // CNNVD: CNNVD-202006-997

SOURCES

db:VULHUBid:VHN-166901
db:VULMONid:CVE-2020-14060
db:JVNDBid:JVNDB-2020-006822
db:PACKETSTORMid:158650
db:PACKETSTORMid:158651
db:PACKETSTORMid:158636
db:CNNVDid:CNNVD-202006-997
db:NVDid:CVE-2020-14060

LAST UPDATE DATE

2024-08-14T12:39:43.828000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-166901date:2021-11-17T00:00:00
db:VULMONid:CVE-2020-14060date:2023-11-07T00:00:00
db:JVNDBid:JVNDB-2020-006822date:2020-08-24T00:00:00
db:CNNVDid:CNNVD-202006-997date:2022-06-10T00:00:00
db:NVDid:CVE-2020-14060date:2023-11-07T03:17:05.777

SOURCES RELEASE DATE

db:VULHUBid:VHN-166901date:2020-06-14T00:00:00
db:VULMONid:CVE-2020-14060date:2020-06-14T00:00:00
db:JVNDBid:JVNDB-2020-006822date:2020-07-20T00:00:00
db:PACKETSTORMid:158650date:2020-07-29T17:52:58
db:PACKETSTORMid:158651date:2020-07-29T17:53:05
db:PACKETSTORMid:158636date:2020-07-29T00:05:59
db:CNNVDid:CNNVD-202006-997date:2020-06-14T00:00:00
db:NVDid:CVE-2020-14060date:2020-06-14T21:15:09.817