CVE-2020-25649
High
Description
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Fasterxml Jackson-databind
PublishedDec 3, 2020
First seenDec 3, 2020
Weakness typeCWE-611XML external entity (XXE)
How to fix
Update
- fasterxml jackson-databind2.6.7.4, 2.9.10.7, 2.10.5.1 or later
- apache iotdb0.12.0 or later
- oracle blockchain_platform21.1.2 or later
- oracle jd_edwards_enterpriseone_orchestrator9.2.5.3 or later
- oracle jd_edwards_enterpriseone_tools9.2.5.3 or later
- com.fasterxml.jackson.core:jackson-databind2.6.7.4, 2.9.10.7, 2.10.5.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fasterxml jackson-databind | 2.6.0 ≤ v < 2.6.7.4, 2.9.0 ≤ v < 2.9.10.7, 2.10.0 ≤ v < 2.10.5.1 | 2.6.7.4, 2.9.10.7, 2.10.5.1 |
| netapp oncommand_api_services | No range specified | — |
| netapp oncommand_workflow_automation | No range specified | — |
| netapp service_level_manager | No range specified | — |
| fedoraproject fedora | 32 | — |
| quarkus quarkus | v ≤ 1.6.1 | — |
| apache iotdb | v < 0.12.0 | 0.12.0 |
| oracle agile_product_lifecycle_management | 9.3.6 | — |
| oracle agile_product_lifecycle_management_integration_pack | 3.6 | — |
| oracle banking_apis | 18.1 ≤ v ≤ 18.3, 19.1, 19.2, 20.1, 21.1 | — |
| oracle banking_platform | 2.6.2, 2.7.0, 2.7.1, 2.8.0, 2.9.0, 2.10.0 | — |
| oracle banking_treasury_management | 4.4 | — |
| oracle blockchain_platform | v < 21.1.2 | 21.1.2 |
| oracle coherence | 12.2.1.4.0, 14.1.1.0.0 | — |
| oracle commerce_platform | 11.3.0 ≤ v ≤ 11.3.2, 11.2.0 | — |
| oracle communications_billing_and_revenue_management | 7.5.0.23.0, 12.0.0.3.0 | — |
| oracle communications_cloud_native_core_unified_data_repository | 1.4.0 | — |
| oracle communications_convergent_charging_controller | 12.0.4.0.0 | — |
| oracle communications_evolved_communications_application_server | 7.1 | — |
| oracle communications_instant_messaging_server | 10.0.1.5.0 | — |
| oracle communications_interactive_session_recorder | 6.3, 6.4 | — |
| oracle communications_network_charging_and_control | 12.0.4.0.0 | — |
| oracle communications_offline_mediation_controller | 12.0.0.3 | — |
| oracle communications_pricing_design_center | 12.0.0.4.0 | — |
| oracle communications_services_gatekeeper | 7.0 | — |
| oracle communications_unified_inventory_management | 7.4.1 | — |
| oracle goldengate_application_adapters | 19.1.0.0.0 | — |
| oracle health_sciences_empirica_signal | 9.0, 9.1 | — |
| oracle insurance_policy_administration | 11.1.0 ≤ v ≤ 11.3.0, 11.0.2 | — |
| oracle insurance_rules_palette | 11.1.0 ≤ v ≤ 11.3.0, 11.0.2 | — |
| oracle jd_edwards_enterpriseone_orchestrator | v < 9.2.5.3 | 9.2.5.3 |
| oracle jd_edwards_enterpriseone_tools | v < 9.2.5.3 | 9.2.5.3 |
| oracle primavera_gateway | 17.7 ≤ v ≤ 17.12, 17.12.0 ≤ v ≤ 17.12.11, 18.8.0 ≤ v ≤ 18.8.11, 19.12.0 ≤ v ≤ 19.12.10, 20.12.0 | — |
| oracle retail_service_backbone | 14.1.3.2, 15.0.3.1, 16.0.3 | — |
| oracle retail_xstore_point_of_service | 16.0.6, 17.0.4, 18.0.3, 19.0.2, 20.0.1 | — |
| oracle sd-wan_edge | 9.0 | — |
| oracle utilities_framework | 4.3.0.5.0, 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0 | — |
| oracle webcenter_portal | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle communications_messaging_server | 8.0.2, 8.1 | — |
| com.fasterxml.jackson.core:jackson-databindMaven | 2.6.0 ≤ v < 2.6.7.4, 2.7.0.0 ≤ v < 2.9.10.7, 2.10.0.0 ≤ v < 2.10.5.1 | 2.6.7.4, 2.9.10.7, 2.10.5.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.