Skip to content

jackson-databind-2.9.2.jar: 54 vulnerabilities (highest severity is: 9.8) #12

Open
Open
jackson-databind-2.9.2.jar: 54 vulnerabilities (highest severity is: 9.8)#12
Labels
Mend: dependency security vulnerabilitySecurity vulnerability detected by Mend

Description

@mend-for-github-com
mend-for-github-com
bot
opened on Mar 20, 2023
Vulnerable Library - jackson-databind-2.9.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /MavenWorkspace/bis-services-lib/bis-businessservices-lib/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar

Vulnerabilities

Vulnerability Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (jackson-databind version) Remediation Possible** Reachability
CVE-2020-9548 Critical 9.8 Not Defined 18.345% jackson-databind-2.9.2.jar Direct 2.9.10.4 ✅
CVE-2020-9547 Critical 9.8 Not Defined 17.757% jackson-databind-2.9.2.jar Direct 2.9.10.4 ✅
CVE-2020-9546 Critical 9.8 Not Defined 4.613% jackson-databind-2.9.2.jar Direct 2.9.10.4 ✅
CVE-2020-8840 Critical 9.8 Not Defined 26.587% jackson-databind-2.9.2.jar Direct 2.9.10.3 ✅
CVE-2019-20330 Critical 9.8 Not Defined 8.64% jackson-databind-2.9.2.jar Direct 2.9.10.2 ✅
CVE-2019-17267 Critical 9.8 Not Defined 4.628% jackson-databind-2.9.2.jar Direct 2.9.10 ✅
CVE-2019-16943 Critical 9.8 Not Defined 4.901% jackson-databind-2.9.2.jar Direct 2.9.10.1 ✅
CVE-2019-16942 Critical 9.8 Not Defined 5.728% jackson-databind-2.9.2.jar Direct 2.9.10.1 ✅
CVE-2019-14540 Critical 9.8 Not Defined 10.763% jackson-databind-2.9.2.jar Direct 2.9.10 ✅
CVE-2018-19360 Critical 9.8 Not Defined 10.599% jackson-databind-2.9.2.jar Direct 2.9.8 ✅
CVE-2020-36184 High 8.8 Not Defined 10.379% jackson-databind-2.9.2.jar Direct 2.9.10.8 ✅
CVE-2020-36182 High 8.8 Not Defined 5.018% jackson-databind-2.9.2.jar Direct 2.9.10.8 ✅
CVE-2020-36181 High 8.8 Not Defined 5.018% jackson-databind-2.9.2.jar Direct 2.9.10.8 ✅
CVE-2020-36180 High 8.8 Not Defined 5.041% jackson-databind-2.9.2.jar Direct 2.9.10.8 ✅
CVE-2020-36179 High 8.8 Not Defined 20.929% jackson-databind-2.9.2.jar Direct 2.9.10.8 ✅
CVE-2020-11113 High 8.8 Not Defined 6.278% jackson-databind-2.9.2.jar Direct 2.9.10.4 ✅
CVE-2020-11112 High 8.8 Not Defined 3.583% jackson-databind-2.9.2.jar Direct 2.9.10.4 ✅
CVE-2020-11111 High 8.8 Not Defined 3.489% jackson-databind-2.9.2.jar Direct 2.9.10.4 ✅
CVE-2020-10969 High 8.8 Not Defined 3.473% jackson-databind-2.9.2.jar Direct 2.9.10.4 ✅
CVE-2020-10968 High 8.8 Not Defined 3.538% jackson-databind-2.9.2.jar Direct 2.9.10.4 ✅
CVE-2020-10673 High 8.8 Not Defined 8.028% jackson-databind-2.9.2.jar Direct 2.9.10.4 ✅
CVE-2020-10672 High 8.8 Not Defined 3.059% jackson-databind-2.9.2.jar Direct 2.9.10.4 ✅
CVE-2021-20190 High 8.1 Not Defined 7.483% jackson-databind-2.9.2.jar Direct 2.9.10.7 ✅
CVE-2020-36189 High 8.1 Not Defined 4.912% jackson-databind-2.9.2.jar Direct 2.9.10.8 ✅
CVE-2020-36188 High 8.1 Not Defined 10.911% jackson-databind-2.9.2.jar Direct 2.9.10.8 ✅
CVE-2020-36187 High 8.1 Not Defined 5.195% jackson-databind-2.9.2.jar Direct 2.9.10.8 ✅
CVE-2020-36186 High 8.1 Not Defined 5.218% jackson-databind-2.9.2.jar Direct 2.9.10.8 ✅
CVE-2020-36185 High 8.1 Not Defined 5.218% jackson-databind-2.9.2.jar Direct 2.9.10.8 ✅
CVE-2020-36183 High 8.1 Not Defined 4.89% jackson-databind-2.9.2.jar Direct 2.9.10.8 ✅
CVE-2020-35728 High 8.1 Not Defined 12.504% jackson-databind-2.9.2.jar Direct com.fasterxml.jackson.core:jackson-databind:2.9.10.8 ✅
CVE-2020-35491 High 8.1 Not Defined 9.477% jackson-databind-2.9.2.jar Direct com.fasterxml.jackson.core:jackson-databind:2.9.10.8 ✅
CVE-2020-35490 High 8.1 Not Defined 7.694% jackson-databind-2.9.2.jar Direct com.fasterxml.jackson.core:jackson-databind:2.9.10.8 ✅
CVE-2020-24750 High 8.1 Not Defined 7.327% jackson-databind-2.9.2.jar Direct 2.9.10.5 ✅
CVE-2020-24616 High 8.1 Not Defined 9.422% jackson-databind-2.9.2.jar Direct 2.9.10.5 ✅
CVE-2020-14195 High 8.1 Not Defined 4.549% jackson-databind-2.9.2.jar Direct 2.9.10.5 ✅
CVE-2020-14062 High 8.1 Not Defined 8.072% jackson-databind-2.9.2.jar Direct 2.9.10.5 ✅
CVE-2020-14061 High 8.1 Not Defined 4.458% jackson-databind-2.9.2.jar Direct 2.9.10.5 ✅
CVE-2020-14060 High 8.1 Not Defined 8.607% jackson-databind-2.9.2.jar Direct 2.9.10.5 ✅
CVE-2020-11620 High 8.1 Not Defined 5.64% jackson-databind-2.9.2.jar Direct 2.9.10.4 ✅
CVE-2020-11619 High 8.1 Not Defined 3.607% jackson-databind-2.9.2.jar Direct 2.9.10.4 ✅
CVE-2020-10650 High 8.1 Not Defined 3.328% jackson-databind-2.9.2.jar Direct 2.9.10.4 ✅
CVE-2019-10202 High 8.1 Not Defined 5.175% jackson-databind-2.9.2.jar Direct 2.9.9 ✅
WS-2026-0003 High 7.5 Not Defined jackson-core-2.9.2.jar Transitive 2.9.5 ✅
WS-2022-0468 High 7.5 Not Defined jackson-core-2.9.2.jar Transitive 2.9.5 ✅
CVE-2026-68494 High 7.5 Not Defined jackson-core-2.9.2.jar Transitive 2.9.5 ✅
CVE-2025-52999 High 7.5 Not Defined 0.634% jackson-core-2.9.2.jar Transitive 2.9.5 ✅
CVE-2022-42004 High 7.5 Not Defined 2.766% jackson-databind-2.9.2.jar Direct 2.12.7.1 ✅
CVE-2022-42003 High 7.5 Not Defined 2.766% jackson-databind-2.9.2.jar Direct 2.12.7.1 ✅
CVE-2020-25649 High 7.5 Not Defined 17.611% jackson-databind-2.9.2.jar Direct 2.9.10.7 ✅
CVE-2019-14892 High 7.5 Not Defined 5.622% jackson-databind-2.9.2.jar Direct 2.9.10 ✅
CVE-2018-12022 High 7.5 Not Defined 7.348% jackson-databind-2.9.2.jar Direct 2.9.6 ✅
CVE-2026-54515 Medium 5.3 Not Defined 0.345% jackson-databind-2.9.2.jar Direct https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.4,com.fasterxml.jackson.core:jackson-databind:2.21.5,com.fasterxml.jackson.core:jackson-databind:2.22.1,https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.9,https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.5,https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.1 ✅
CVE-2026-54514 Medium 5.3 Not Defined 0.219% jackson-databind-2.9.2.jar Direct https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.8 ✅
CVE-2025-49128 Medium 4.0 Not Defined 0.339% jackson-core-2.9.2.jar Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

Partial details (20 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2020-9548

Vulnerable Library - jackson-databind-2.9.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /MavenWorkspace/bis-services-lib/bis-businessservices-lib/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar

Dependency Hierarchy:

  • ❌ jackson-databind-2.9.2.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

Publish Date: 2020-03-02

URL: CVE-2020-9548

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 18.345%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9548

Release Date: 2020-03-02

Fix Resolution: 2.9.10.4

In order to enable automatic remediation, please create workflow rules

CVE-2020-9547

Vulnerable Library - jackson-databind-2.9.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /MavenWorkspace/bis-services-lib/bis-businessservices-lib/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar

Dependency Hierarchy:

  • ❌ jackson-databind-2.9.2.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

Publish Date: 2020-03-02

URL: CVE-2020-9547

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 17.757%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://osv.dev/vulnerability/GHSA-q93h-jc49-78gg

Release Date: 2020-03-02

Fix Resolution: 2.9.10.4

In order to enable automatic remediation, please create workflow rules

CVE-2020-9546

Vulnerable Library - jackson-databind-2.9.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /MavenWorkspace/bis-services-lib/bis-businessservices-lib/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar

Dependency Hierarchy:

  • ❌ jackson-databind-2.9.2.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

Publish Date: 2020-03-02

URL: CVE-2020-9546

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 4.613%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9546

Release Date: 2020-03-02

Fix Resolution: 2.9.10.4

In order to enable automatic remediation, please create workflow rules

CVE-2020-8840

Vulnerable Library - jackson-databind-2.9.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /MavenWorkspace/bis-services-lib/bis-businessservices-lib/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar

Dependency Hierarchy:

  • ❌ jackson-databind-2.9.2.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

Publish Date: 2020-02-10

URL: CVE-2020-8840

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 26.587%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-02-10

Fix Resolution: 2.9.10.3

In order to enable automatic remediation, please create workflow rules

CVE-2019-20330

Vulnerable Library - jackson-databind-2.9.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /MavenWorkspace/bis-services-lib/bis-businessservices-lib/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar

Dependency Hierarchy:

  • ❌ jackson-databind-2.9.2.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.

Publish Date: 2020-01-03

URL: CVE-2019-20330

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 8.64%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-01-03

Fix Resolution: 2.9.10.2

In order to enable automatic remediation, please create workflow rules

CVE-2019-17267

Vulnerable Library - jackson-databind-2.9.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /MavenWorkspace/bis-services-lib/bis-businessservices-lib/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar

Dependency Hierarchy:

  • ❌ jackson-databind-2.9.2.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

Publish Date: 2019-10-06

URL: CVE-2019-17267

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 4.628%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-10-06

Fix Resolution: 2.9.10

In order to enable automatic remediation, please create workflow rules

CVE-2019-16943

Vulnerable Library - jackson-databind-2.9.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /MavenWorkspace/bis-services-lib/bis-businessservices-lib/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar

Dependency Hierarchy:

  • ❌ jackson-databind-2.9.2.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.

Publish Date: 2019-10-01

URL: CVE-2019-16943

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 4.901%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://osv.dev/vulnerability/GHSA-fmmc-742q-jg75

Release Date: 2019-10-01

Fix Resolution: 2.9.10.1

In order to enable automatic remediation, please create workflow rules

CVE-2019-16942

Vulnerable Library - jackson-databind-2.9.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /MavenWorkspace/bis-services-lib/bis-businessservices-lib/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar

Dependency Hierarchy:

  • ❌ jackson-databind-2.9.2.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.

Publish Date: 2019-10-01

URL: CVE-2019-16942

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 5.728%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://osv.dev/vulnerability/GHSA-mx7p-6679-8g3q

Release Date: 2019-10-01

Fix Resolution: 2.9.10.1

In order to enable automatic remediation, please create workflow rules

CVE-2019-14540

Vulnerable Library - jackson-databind-2.9.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /MavenWorkspace/bis-services-lib/bis-businessservices-lib/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar

Dependency Hierarchy:

  • ❌ jackson-databind-2.9.2.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.

Publish Date: 2019-09-15

URL: CVE-2019-14540

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 10.763%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://osv.dev/vulnerability/GHSA-h822-r4r5-v8jg

Release Date: 2019-09-15

Fix Resolution: 2.9.10

In order to enable automatic remediation, please create workflow rules

CVE-2018-19360

Vulnerable Library - jackson-databind-2.9.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /MavenWorkspace/bis-services-lib/bis-businessservices-lib/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar

Dependency Hierarchy:

  • ❌ jackson-databind-2.9.2.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.

Publish Date: 2019-01-02

URL: CVE-2018-19360

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 10.599%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://osv.dev/vulnerability/GHSA-f9hv-mg5h-xcw9

Release Date: 2019-01-02

Fix Resolution: 2.9.8

In order to enable automatic remediation, please create workflow rules

CVE-2020-36184

Vulnerable Library - jackson-databind-2.9.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /MavenWorkspace/bis-services-lib/bis-businessservices-lib/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar

Dependency Hierarchy:

  • ❌ jackson-databind-2.9.2.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.

Publish Date: 2021-01-06

URL: CVE-2020-36184

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 10.379%

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-01-06

Fix Resolution: 2.9.10.8

In order to enable automatic remediation, please create workflow rules

CVE-2020-36182

Vulnerable Library - jackson-databind-2.9.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /MavenWorkspace/bis-services-lib/bis-businessservices-lib/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar

Dependency Hierarchy:

  • ❌ jackson-databind-2.9.2.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.

Publish Date: 2021-01-06

URL: CVE-2020-36182

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 5.018%

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-01-06

Fix Resolution: 2.9.10.8

In order to enable automatic remediation, please create workflow rules

CVE-2020-36181

Vulnerable Library - jackson-databind-2.9.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /MavenWorkspace/bis-services-lib/bis-businessservices-lib/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar

Dependency Hierarchy:

  • ❌ jackson-databind-2.9.2.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.

Publish Date: 2021-01-06

URL: CVE-2020-36181

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 5.018%

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-01-06

Fix Resolution: 2.9.10.8

In order to enable automatic remediation, please create workflow rules

CVE-2020-36180

Vulnerable Library - jackson-databind-2.9.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /MavenWorkspace/bis-services-lib/bis-businessservices-lib/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar

Dependency Hierarchy:

  • ❌ jackson-databind-2.9.2.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.

Publish Date: 2021-01-06

URL: CVE-2020-36180

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 5.041%

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-01-06

Fix Resolution: 2.9.10.8

In order to enable automatic remediation, please create workflow rules

CVE-2020-36179

Vulnerable Library - jackson-databind-2.9.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /MavenWorkspace/bis-services-lib/bis-businessservices-lib/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar

Dependency Hierarchy:

  • ❌ jackson-databind-2.9.2.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.

Publish Date: 2021-01-06

URL: CVE-2020-36179

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 20.929%

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-01-06

Fix Resolution: 2.9.10.8

In order to enable automatic remediation, please create workflow rules

CVE-2020-11113

Vulnerable Library - jackson-databind-2.9.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /MavenWorkspace/bis-services-lib/bis-businessservices-lib/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar

Dependency Hierarchy:

  • ❌ jackson-databind-2.9.2.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).

Publish Date: 2020-03-31

URL: CVE-2020-11113

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 6.278%

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11113

Release Date: 2020-03-31

Fix Resolution: 2.9.10.4

In order to enable automatic remediation, please create workflow rules

CVE-2020-11112

Vulnerable Library - jackson-databind-2.9.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /MavenWorkspace/bis-services-lib/bis-businessservices-lib/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar

Dependency Hierarchy:

  • ❌ jackson-databind-2.9.2.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).

Publish Date: 2020-03-31

URL: CVE-2020-11112

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 3.583%

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11112

Release Date: 2020-03-31

Fix Resolution: 2.9.10.4

In order to enable automatic remediation, please create workflow rules

CVE-2020-11111

Vulnerable Library - jackson-databind-2.9.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /MavenWorkspace/bis-services-lib/bis-businessservices-lib/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar

Dependency Hierarchy:

  • ❌ jackson-databind-2.9.2.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).

Publish Date: 2020-03-31

URL: CVE-2020-11111

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 3.489%

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11113

Release Date: 2020-03-31

Fix Resolution: 2.9.10.4

In order to enable automatic remediation, please create workflow rules

CVE-2020-10969

Vulnerable Library - jackson-databind-2.9.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /MavenWorkspace/bis-services-lib/bis-businessservices-lib/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar

Dependency Hierarchy:

  • ❌ jackson-databind-2.9.2.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.

Publish Date: 2020-03-26

URL: CVE-2020-10969

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 3.473%

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10969

Release Date: 2020-03-26

Fix Resolution: 2.9.10.4

In order to enable automatic remediation, please create workflow rules

CVE-2020-10968

Vulnerable Library - jackson-databind-2.9.2.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /MavenWorkspace/bis-services-lib/bis-businessservices-lib/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.2/jackson-databind-2.9.2.jar

Dependency Hierarchy:

  • ❌ jackson-databind-2.9.2.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).

Publish Date: 2020-03-26

URL: CVE-2020-10968

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 3.538%

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-10968

Release Date: 2020-03-26

Fix Resolution: 2.9.10.4

In order to enable automatic remediation, please create workflow rules

In order to enable automatic remediation for this issue, please create workflow rules

Metadata

Metadata

Assignees

No one assigned

    Labels

    Mend: dependency security vulnerabilitySecurity vulnerability detected by Mend

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions