Sign-up

ID

VAR-202008-1215


CVE

CVE-2020-24616


TITLE

FasterXML jackson-databind Code injection vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2020-008259

DESCRIPTION

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP). FasterXML jackson-databind Exists in a code injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Versions earlier than 2.9.10.6 in the FasterXML jackson-databind 2.x series have security vulnerabilities. Currently there is no information about this vulnerability, please keep an eye on CNNVD or vendor announcements

Trust: 1.8

sources: NVD: CVE-2020-24616 // JVNDB: JVNDB-2020-008259 // VULHUB: VHN-178512 // VULMON: CVE-2020-24616

AFFECTED PRODUCTS

vendor:oraclemodel:communications calendar serverscope:eqversion:8.0.0.4.0

Trust: 1.0

vendor:netappmodel:active iq unified managerscope:eqversion: -

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:9.0

Trust: 1.0

vendor:oraclemodel:banking liquidity managementscope:eqversion:14.5

Trust: 1.0

vendor:oraclemodel:communications calendar serverscope:eqversion:8.0

Trust: 1.0

vendor:oraclemodel:banking supply chain financescope:eqversion:14.2

Trust: 1.0

vendor:oraclemodel:communications pricing design centerscope:eqversion:12.0.0.4.0

Trust: 1.0

vendor:oraclemodel:communications instant messaging serverscope:eqversion:10.0.1.5.0

Trust: 1.0

vendor:oraclemodel:agile plmscope:eqversion:9.3.6

Trust: 1.0

vendor:oraclemodel:banking supply chain financescope:eqversion:14.3

Trust: 1.0

vendor:oraclemodel:communications cloud native core unified data repositoryscope:eqversion:1.4.0

Trust: 1.0

vendor:oraclemodel:communications diameter signaling routerscope:lteversion:8.2.2

Trust: 1.0

vendor:oraclemodel:communications policy managementscope:eqversion:12.5.0

Trust: 1.0

vendor:oraclemodel:application testing suitescope:eqversion:13.3.0.1

Trust: 1.0

vendor:oraclemodel:communications element managerscope:gteversion:8.2.0

Trust: 1.0

vendor:oraclemodel:banking liquidity managementscope:eqversion:14.2

Trust: 1.0

vendor:oraclemodel:blockchain platformscope:ltversion:21.1.2

Trust: 1.0

vendor:oraclemodel:communications services gatekeeperscope:eqversion:7.0

Trust: 1.0

vendor:oraclemodel:communications session report managerscope:lteversion:8.2.2.1

Trust: 1.0

vendor:oraclemodel:banking liquidity managementscope:eqversion:14.3

Trust: 1.0

vendor:oraclemodel:communications contacts serverscope:eqversion:8.0

Trust: 1.0

vendor:oraclemodel:communications element managerscope:lteversion:8.2.4.0

Trust: 1.0

vendor:fasterxmlmodel:jackson-databindscope:gteversion:2.0.0

Trust: 1.0

vendor:oraclemodel:communications evolved communications application serverscope:eqversion:7.1

Trust: 1.0

vendor:oraclemodel:autovue for agile product lifecycle managementscope:eqversion:21.0.2

Trust: 1.0

vendor:oraclemodel:communications unified inventory managementscope:eqversion:7.4.1

Trust: 1.0

vendor:oraclemodel:siebel ui frameworkscope:lteversion:21.2

Trust: 1.0

vendor:oraclemodel:communications diameter signaling routerscope:gteversion:8.0.0

Trust: 1.0

vendor:oraclemodel:communications contacts serverscope:eqversion:8.0.0.5.0

Trust: 1.0

vendor:oraclemodel:communications session report managerscope:gteversion:8.0.0.0

Trust: 1.0

vendor:fasterxmlmodel:jackson-databindscope:ltversion:2.9.10.6

Trust: 1.0

vendor:oraclemodel:communications messaging serverscope:eqversion:8.1

Trust: 1.0

vendor:oraclemodel:communications offline mediation controllerscope:eqversion:12.0.0.3

Trust: 1.0

vendor:oraclemodel:banking supply chain financescope:eqversion:14.5

Trust: 1.0

vendor:oraclemodel:identity manager connectorscope:eqversion:11.1.1.5.0

Trust: 1.0

vendor:fasterxmlmodel:jackson-databindscope:eqversion:2.9.10.6

Trust: 0.8

sources: JVNDB: JVNDB-2020-008259 // NVD: CVE-2020-24616

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-24616
value: HIGH

Trust: 1.0

NVD: JVNDB-2020-008259
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202008-1195
value: HIGH

Trust: 0.6

VULHUB: VHN-178512
value: MEDIUM

Trust: 0.1

VULMON: CVE-2020-24616
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-24616
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

NVD: JVNDB-2020-008259
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

VULHUB: VHN-178512
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-24616
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.2
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: JVNDB-2020-008259
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-178512 // VULMON: CVE-2020-24616 // JVNDB: JVNDB-2020-008259 // CNNVD: CNNVD-202008-1195 // NVD: CVE-2020-24616

PROBLEMTYPE DATA

problemtype:CWE-502

Trust: 1.1

problemtype:CWE-94

Trust: 0.9

sources: VULHUB: VHN-178512 // JVNDB: JVNDB-2020-008259 // NVD: CVE-2020-24616

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202008-1195

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-202008-1195

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2020-008259

PATCH
title:Update Jackson-databind to 2.9.10.6  #902url:https://github.com/Cryptonomic/Conseil/issues/902
Trust: 0.8
title:FasterXML jackson-databind Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=127486
Trust: 0.6
title:Hitachi Security Advisories: Multiple Vulnerabilities in Cosminexusurl:https://vulmon.com/vendoradvisory?qidtp=hitachi_security_advisories&qid=hitachi-sec-2021-109
Trust: 0.1
title:cve-2020-24616-pocurl:https://github.com/Kamimuka/cve-2020-24616-poc 
Trust: 0.1
sources:
            
            
            VULMON: CVE-2020-24616 // 
            
            
            
            JVNDB: JVNDB-2020-008259 // 
            
            
            
            CNNVD: CNNVD-202008-1195

EXTERNAL IDS
db:NVDid:CVE-2020-24616
Trust: 2.6
db:JVNDBid:JVNDB-2020-008259
Trust: 0.8
db:CNNVDid:CNNVD-202008-1195
Trust: 0.7
db:AUSCERTid:ESB-2020.3558
Trust: 0.6
db:AUSCERTid:ESB-2021.1397
Trust: 0.6
db:CS-HELPid:SB2022060909
Trust: 0.6
db:CNVDid:CNVD-2020-48577
Trust: 0.1
db:VULHUBid:VHN-178512
Trust: 0.1
db:VULMONid:CVE-2020-24616
Trust: 0.1
sources:
            
            
            VULHUB: VHN-178512 // 
            
            
            
            VULMON: CVE-2020-24616 // 
            
            
            
            JVNDB: JVNDB-2020-008259 // 
            
            
            
            CNNVD: CNNVD-202008-1195 // 
            
            
            
            NVD: CVE-2020-24616

REFERENCES
url:https://security.netapp.com/advisory/ntap-20200904-0006/
Trust: 1.7
url:https://github.com/fasterxml/jackson-databind/issues/2814
Trust: 1.7
url:https://www.oracle.com//security-alerts/cpujul2021.html
Trust: 1.7
url:https://www.oracle.com/security-alerts/cpuapr2021.html
Trust: 1.7
url:https://www.oracle.com/security-alerts/cpuapr2022.html
Trust: 1.7
url:https://www.oracle.com/security-alerts/cpujan2021.html
Trust: 1.7
url:https://www.oracle.com/security-alerts/cpujan2022.html
Trust: 1.7
url:https://www.oracle.com/security-alerts/cpuoct2021.html
Trust: 1.7
url:https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2020-24616
Trust: 1.4
url:https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
Trust: 1.0
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-24616
Trust: 0.8
url:https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
Trust: 0.7
url:https://www.auscert.org.au/bulletins/esb-2020.3558/
Trust: 0.6
url:https://www.ibm.com/blogs/psirt/security-bulletin-jackson-databind-vulnerability-cve-2020-24616-impacts-ibm-aspera-high-speed-transfer-server-and-aspera-high-speed-transfer-endpoint-versions-prior-to-v4-0/
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2022060909
Trust: 0.6
url:https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-jquery-spring-dom4j-mongodb-linux-kernel-targetcli-fb-jackson-node-js-and-apache-commons-affect-ibm-spectrum-protect-plus/
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2021.1397
Trust: 0.6
url:https://www.ibm.com/support/pages/node/6525182
Trust: 0.6
url:https://vigilance.fr/vulnerability/fasterxml-jackson-databind-code-execution-via-br-com-anteros-anteros-dbc-33951
Trust: 0.6
url:https://www.ibm.com/blogs/psirt/security-bulletin-potential-vulnerability-with-fasterxml-jackson-databind-2/
Trust: 0.6
url:https://www.ibm.com/support/pages/node/6528214
Trust: 0.6
sources:
            
            
            VULHUB: VHN-178512 // 
            
            
            
            JVNDB: JVNDB-2020-008259 // 
            
            
            
            CNNVD: CNNVD-202008-1195 // 
            
            
            
            NVD: CVE-2020-24616

SOURCES
db:VULHUBid:VHN-178512
db:VULMONid:CVE-2020-24616
db:JVNDBid:JVNDB-2020-008259
db:CNNVDid:CNNVD-202008-1195
db:NVDid:CVE-2020-24616

LAST UPDATE DATE
2024-08-14T12:19:11.374000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-178512date:2022-05-12T00:00:00
db:VULMONid:CVE-2020-24616date:2023-11-07T00:00:00
db:JVNDBid:JVNDB-2020-008259date:2020-09-07T00:00:00
db:CNNVDid:CNNVD-202008-1195date:2022-06-10T00:00:00
db:NVDid:CVE-2020-24616date:2023-11-07T03:20:08.953

SOURCES RELEASE DATE
db:VULHUBid:VHN-178512date:2020-08-25T00:00:00
db:VULMONid:CVE-2020-24616date:2020-08-25T00:00:00
db:JVNDBid:JVNDB-2020-008259date:2020-09-07T00:00:00
db:CNNVDid:CNNVD-202008-1195date:2020-08-25T00:00:00
db:NVDid:CVE-2020-24616date:2020-08-25T18:15:11.133