variot - var-202003-1785

var-202003-1785

Vulnerability from variot

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa). FasterXML jackson-databind contains an untrusted data deserialization vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. FasterXML Jackson is a data processing tool for Java developed by American FasterXML Company. jackson-databind is one of the components with data binding function. A security vulnerability exists in FasterXML jackson-databind 2.x versions prior to 2.9.10.4. Currently there is no information about this vulnerability, please keep an eye on CNNVD or vendor announcements. Description:

Red Hat Decision Manager is an open source decision management platform that combines business rules management, complex event processing, Decision Model & Notation (DMN) execution, and Business Optimizer for solving planning problems. It automates business decisions and makes that logic available to the entire business.

It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.

Security Fix(es):

apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default (CVE-2019-10086)
cxf: does not restrict the number of message attachments (CVE-2019-12406)
cxf: OpenId Connect token service does not properly validate the clientId (CVE-2019-12419)
hibernate-validator: safeHTML validator allows XSS (CVE-2019-10219)
HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)
HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)
HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)
HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)
jackson-databind: Multiple serialization gadgets (CVE-2019-17531, CVE-2019-16943, CVE-2019-16942, CVE-2019-17267, CVE-2019-14540, CVE-2019-16335, CVE-2019-14893, CVE-2019-14892, CVE-2020-9546, CVE-2020-9547, CVE-2020-9548, CVE-2020-10969, CVE-2020-10968, CVE-2020-11111, CVE-2020-11112, CVE-2020-11113, CVE-2020-11619, CVE-2020-11620, CVE-2019-20330, CVE-2020-8840)
jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution (CVE-2020-10672, CVE-2020-10673)
keycloak: adapter endpoints are exposed via arbitrary URLs (CVE-2019-14820)
keycloak: missing signatures validation on CRL used to verify client certificates (CVE-2019-3875)
keycloak: SAML broker does not check existence of signature on document allowing any user impersonation (CVE-2019-10201)
keycloak: CSRF check missing in My Resources functionality in the Account Console (CVE-2019-10199)
keycloak: cross-realm user access auth bypass (CVE-2019-14832)
netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238)
SmallRye: SecuritySupport class is incorrectly public and contains a static method to access the current threads context class loader (CVE-2020-1729)
thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol (CVE-2019-0210)
thrift: Endless loop when feed with specific input data (CVE-2019-0205)
undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS (CVE-2019-14888)
wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use (CVE-2019-14887)
wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and 'Deployer' user by default (CVE-2019-14838)
xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source (CVE-2019-12400)

For more details about the security issues and their impact, the CVSS score, acknowledgements, and other related information, see the CVE pages listed in the References section. You must be logged in to download the update.

NOTE: This advisory is an addendum to https://access.redhat.com/errata/RHBA-2020:1414 and is an informational advisory only, to clarify security fixes released therein. No code has been modified as part of this advisory. Description:

Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Bugs fixed (https://bugzilla.redhat.com/):

1800573 - CVE-2020-1727 keycloak: missing input validation in IDP authorization URLs 1819208 - CVE-2020-10968 jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider 1821304 - CVE-2020-11111 jackson-databind: Serialization gadgets in org.apache.activemq.jms.pool.XaPooledConnectionFactory 1821311 - CVE-2020-11112 jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider 1821315 - CVE-2020-11113 jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime 1826798 - CVE-2020-11620 jackson-databind: Serialization gadgets in commons-jelly:commons-jelly 1826805 - CVE-2020-11619 jackson-databind: Serialization gadgets in org.springframework:spring-aop

Summary:

This is a security update for JBoss EAP Continuous Delivery 19. JIRA issues fixed (https://issues.jboss.org/):

JBEAP-18881 - Upgrade Undertow to 2.0.30.SP1 JBEAP-18974 - Upgrade snakeyaml to 1.26 JBEAP-18975 - Upgrade cryptacular to 1.2.4 JBEAP-18982 - Upgrade WildFly Core to 11.0.0.Final-redhat-00001 JBEAP-18983 - Upgrade Remoting JMX from 3.0.3 to 3.0.4 JBEAP-19041 - Upgrade WildFly Elytron to 1.11.3.Final JBEAP-19042 - Upgrade wildfly-core to 11.0.2.Final JBEAP-19076 - Upgrade resteasy from 3.11.0.Final to 3.11.1.Final JBEAP-19211 - Empty section Fixed CVEs in CD19 Release Notes

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Important: Red Hat Data Grid 7.3.7 security update Advisory ID: RHSA-2020:3779-01 Product: Red Hat JBoss Data Grid Advisory URL: https://access.redhat.com/errata/RHSA-2020:3779 Issue date: 2020-09-17 CVE Names: CVE-2017-7658 CVE-2019-10172 CVE-2020-1695 CVE-2020-1710 CVE-2020-1719 CVE-2020-1745 CVE-2020-1748 CVE-2020-1757 CVE-2020-8840 CVE-2020-9488 CVE-2020-9546 CVE-2020-9547 CVE-2020-9548 CVE-2020-10672 CVE-2020-10673 CVE-2020-10714 CVE-2020-10968 CVE-2020-10969 CVE-2020-11111 CVE-2020-11112 CVE-2020-11113 CVE-2020-11612 CVE-2020-11619 CVE-2020-11620 ==================================================================== 1. Summary:

An update for Red Hat Data Grid is now available.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description:

Red Hat Data Grid is a distributed, in-memory, NoSQL datastore based on the Infinispan project.

This release of Red Hat Data Grid 7.3.7 serves as a replacement for Red Hat Data Grid 7.3.6 and includes bug fixes and enhancements, which are described in the Release Notes, linked to in the References section of this erratum.

Security Fix(es):

jetty: Incorrect header handling (CVE-2017-7658)
EAP: field-name is not parsed in accordance to RFC7230 (CVE-2020-1710)
undertow: AJP File Read/Inclusion Vulnerability (CVE-2020-1745)
undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass (CVE-2020-1757)
jackson-databind: Lacks certain xbean-reflect/JNDI blocking (CVE-2020-8840)
jackson-databind: Serialization gadgets in shaded-hikari-config (CVE-2020-9546)
jackson-databind: Serialization gadgets in ibatis-sqlmap (CVE-2020-9547)
jackson-databind: Serialization gadgets in anteros-core (CVE-2020-9548)
jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution (CVE-2020-10672)
jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution (CVE-2020-10673)
jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider (CVE-2020-10968)
jackson-databind: Serialization gadgets in javax.swing.JEditorPane (CVE-2020-10969)
jackson-databind: Serialization gadgets in org.apache.activemq.jms.pool.XaPooledConnectionFactory (CVE-2020-11111)
jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider (CVE-2020-11112)
jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime (CVE-2020-11113)
jackson-databind: Serialization gadgets in org.springframework:spring-aop (CVE-2020-11619)
jackson-databind: Serialization gadgets in commons-jelly:commons-jelly (CVE-2020-11620)
jackson-mapper-asl: XML external entity similar to CVE-2016-3720 (CVE-2019-10172)
resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class (CVE-2020-1695)
Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain (CVE-2020-1719)
Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain (CVE-2020-1748)
wildfly-elytron: session fixation when using FORM authentication (CVE-2020-10714)
netty: compression/decompression codecs don't enforce limits on buffer allocation sizes (CVE-2020-11612)
log4j: improper validation of certificate with host mismatch in SMTP appender (CVE-2020-9488)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution:

To install this update, do the following:

Download the Data Grid 7.3.7 server patch from the customer portal. See the download link in the References section.
Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.
Install the Data Grid 7.3.7 server patch. Refer to the 7.3 Release Notes for patching instructions.
Restart Data Grid to ensure the changes take effect.
Bugs fixed (https://bugzilla.redhat.com/):

1595621 - CVE-2017-7658 jetty: Incorrect header handling 1715075 - CVE-2019-10172 jackson-mapper-asl: XML external entity similar to CVE-2016-3720 1730462 - CVE-2020-1695 resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class 1752770 - CVE-2020-1757 undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass 1793970 - CVE-2020-1710 EAP: field-name is not parsed in accordance to RFC7230 1796617 - CVE-2020-1719 Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain 1807305 - CVE-2020-1745 undertow: AJP File Read/Inclusion Vulnerability 1807707 - CVE-2020-1748 Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain 1815470 - CVE-2020-10673 jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution 1815495 - CVE-2020-10672 jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution 1816216 - CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes 1816330 - CVE-2020-8840 jackson-databind: Lacks certain xbean-reflect/JNDI blocking 1816332 - CVE-2020-9546 jackson-databind: Serialization gadgets in shaded-hikari-config 1816337 - CVE-2020-9547 jackson-databind: Serialization gadgets in ibatis-sqlmap 1816340 - CVE-2020-9548 jackson-databind: Serialization gadgets in anteros-core 1819208 - CVE-2020-10968 jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider 1819212 - CVE-2020-10969 jackson-databind: Serialization gadgets in javax.swing.JEditorPane 1821304 - CVE-2020-11111 jackson-databind: Serialization gadgets in org.apache.activemq.jms.pool.XaPooledConnectionFactory 1821311 - CVE-2020-11112 jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider 1821315 - CVE-2020-11113 jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime 1825714 - CVE-2020-10714 wildfly-elytron: session fixation when using FORM authentication 1826798 - CVE-2020-11620 jackson-databind: Serialization gadgets in commons-jelly:commons-jelly 1826805 - CVE-2020-11619 jackson-databind: Serialization gadgets in org.springframework:spring-aop 1831139 - CVE-2020-9488 log4j: improper validation of certificate with host mismatch in SMTP appender

References:

https://access.redhat.com/security/cve/CVE-2017-7658 https://access.redhat.com/security/cve/CVE-2019-10172 https://access.redhat.com/security/cve/CVE-2020-1695 https://access.redhat.com/security/cve/CVE-2020-1710 https://access.redhat.com/security/cve/CVE-2020-1719 https://access.redhat.com/security/cve/CVE-2020-1745 https://access.redhat.com/security/cve/CVE-2020-1748 https://access.redhat.com/security/cve/CVE-2020-1757 https://access.redhat.com/security/cve/CVE-2020-8840 https://access.redhat.com/security/cve/CVE-2020-9488 https://access.redhat.com/security/cve/CVE-2020-9546 https://access.redhat.com/security/cve/CVE-2020-9547 https://access.redhat.com/security/cve/CVE-2020-9548 https://access.redhat.com/security/cve/CVE-2020-10672 https://access.redhat.com/security/cve/CVE-2020-10673 https://access.redhat.com/security/cve/CVE-2020-10714 https://access.redhat.com/security/cve/CVE-2020-10968 https://access.redhat.com/security/cve/CVE-2020-10969 https://access.redhat.com/security/cve/CVE-2020-11111 https://access.redhat.com/security/cve/CVE-2020-11112 https://access.redhat.com/security/cve/CVE-2020-11113 https://access.redhat.com/security/cve/CVE-2020-11612 https://access.redhat.com/security/cve/CVE-2020-11619 https://access.redhat.com/security/cve/CVE-2020-11620 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product\xdata.grid&downloadType=securityPatches&version=7.3 https://access.redhat.com/documentation/en-us/red_hat_data_grid/7.3/html/red_hat_data_grid_7.3_release_notes/index

Contact:

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/

iQIVAwUBX2Nf/dzjgjWX9erEAQifjA/7BlSA2KK7e4RlxfRAP3Sj7xT+CRlFcOJn NVVI6DNpfZNtD/TJ4M5JFMP/yzKb+/FoaGVUexqiUxQBcrYsViZdfwfQ6PSwQgd8 5GAtC0NINGYmr0y7m6sKbAwAofnmCoEjNPjpdfLG632Err4vXDT9pGx1RNIrfS0A qaOSuf2BjZkD9A6Azroupq/ePmRnDBW4ovWF4ES415Pa5T7N4rmoyZ3UnGrbubmm GisjzhBbFyjL2wM1gMtqKlf5Qdre0XQIio4YLEnK1DaS7qLS36L04UJP9rwtB/nn aCOKZE/4Ch0gYcNlwniH4MK4Aiy/z/OGQopuhJoKFADJ3Y5lnJwCWDMjMKwWSj1G DvKG4uSIa8l2oxGQURThwxY1Jr7sbQTy2QXCVoyZj9oOKoGel+qJaGVFVnwsOpB7 MB8nPAuINZ91RR7xSBLv/AyoLnXV3dI97kOyTwEhld6THIwAUWqk+V2y7M6Onlx9 Pf+whfe0ORHzeCj/UBZh2NqcuShUpjdE9aLyYyefa2VV4t+0L4XlIfnlNuL8Ja7j wzLJlo/u8XMktoXRrBpMWZaCzcqN1+BTuQUXNZeqfNtgFmCgJVxp6tHyHni7flQq P2M8FaCyQHyQ1ggSljgZ66AEdiwatYpqOxR4yUyrKmsXt9iPsX45TdA9zSKmF2Sb PyKX8lLP6w8=n+2X -----END PGP SIGNATURE-----

-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . The purpose of this text-only errata is to inform you about the security issues fixed in this release.

Installation instructions are available from the Fuse 7.7.0 product documentation page: https://access.redhat.com/documentation/en-us/red_hat_fuse/7.7/

Bugs fixed (https://bugzilla.redhat.com/):

1343616 - CVE-2016-4970 netty: Infinite loop vulnerability when handling renegotiation using SslProvider.OpenSsl 1620529 - CVE-2018-1000632 dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents 1632452 - CVE-2018-3831 elasticsearch: Information exposure via _cluster/settings API 1637492 - CVE-2018-11797 pdfbox: unbounded computation in parser resulting in a denial of service 1638391 - CVE-2018-12541 vertx: WebSocket HTTP upgrade implementation holds the entire http request in memory before the handshake 1697598 - CVE-2019-3797 spring-data-jpa: Additional information exposure with Spring Data JPA derived queries 1700016 - CVE-2019-0231 mina-core: Retaining an open socket in close_notify SSL-TLS leading to Information disclosure. 1713468 - CVE-2019-12086 jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server. Relevant releases/architectures:

6Client-AMQ-Clients-2 - i386, noarch, x86_64 6ComputeNode-AMQ-Clients-2 - noarch, x86_64 6Server-AMQ-Clients-2 - i386, noarch, x86_64 6Workstation-AMQ-Clients-2 - i386, noarch, x86_64 7Client-AMQ-Clients-2 - noarch, x86_64 7ComputeNode-AMQ-Clients-2 - noarch, x86_64 7Server-AMQ-Clients-2 - noarch, x86_64 7Workstation-AMQ-Clients-2 - noarch, x86_64 8Base-AMQ-Clients-2 - noarch, x86_64

Description:

Red Hat AMQ Clients enable connecting, sending, and receiving messages over the AMQP 1.0 wire transport protocol to or from AMQ Broker 6 and 7. Solution:

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Bugs fixed (https://bugzilla.redhat.com/):

1821315 - CVE-2020-11113 jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime 1831139 - CVE-2020-9488 log4j: improper validation of certificate with host mismatch in SMTP appender 1851327 - CVE-2020-14307 wildfly: EJB SessionOpenInvocations may not be removed properly after a response is received causing Denial of Service 1853595 - CVE-2020-14297 wildfly: Some EJB transaction objects may get accumulated causing Denial of Service

JIRA issues fixed (https://issues.jboss.org/):

ENTMQCL-1987 - AMQ Resource Adapter example project is incompatible with Maven 3.6 ENTMQCL-1988 - AMQ Resource Adapter example project does not run ENTMQCL-2070 - [jms] Log successful reconnects more prominently

Package List:

6Client-AMQ-Clients-2:

Source: qpid-cpp-1.36.0-31.el6_10amq.src.rpm qpid-proton-0.32.0-1.el6_10.src.rpm

i386: python-qpid-proton-0.32.0-1.el6_10.i686.rpm qpid-proton-c-0.32.0-1.el6_10.i686.rpm qpid-proton-c-devel-0.32.0-1.el6_10.i686.rpm qpid-proton-cpp-0.32.0-1.el6_10.i686.rpm qpid-proton-cpp-devel-0.32.0-1.el6_10.i686.rpm qpid-proton-debuginfo-0.32.0-1.el6_10.i686.rpm

noarch: python-qpid-proton-docs-0.32.0-1.el6_10.noarch.rpm qpid-cpp-client-docs-1.36.0-31.el6_10amq.noarch.rpm qpid-proton-c-docs-0.32.0-1.el6_10.noarch.rpm qpid-proton-cpp-docs-0.32.0-1.el6_10.noarch.rpm qpid-proton-tests-0.32.0-1.el6_10.noarch.rpm

x86_64: python-qpid-proton-0.32.0-1.el6_10.x86_64.rpm qpid-cpp-client-1.36.0-31.el6_10amq.x86_64.rpm qpid-cpp-client-devel-1.36.0-31.el6_10amq.x86_64.rpm qpid-cpp-debuginfo-1.36.0-31.el6_10amq.x86_64.rpm qpid-proton-c-0.32.0-1.el6_10.x86_64.rpm qpid-proton-c-devel-0.32.0-1.el6_10.x86_64.rpm qpid-proton-cpp-0.32.0-1.el6_10.x86_64.rpm qpid-proton-cpp-devel-0.32.0-1.el6_10.x86_64.rpm qpid-proton-debuginfo-0.32.0-1.el6_10.x86_64.rpm

6ComputeNode-AMQ-Clients-2:

Source: qpid-cpp-1.36.0-31.el6_10amq.src.rpm qpid-proton-0.32.0-1.el6_10.src.rpm

6Server-AMQ-Clients-2:

Source: qpid-cpp-1.36.0-31.el6_10amq.src.rpm qpid-proton-0.32.0-1.el6_10.src.rpm

6Workstation-AMQ-Clients-2:

Source: qpid-cpp-1.36.0-31.el6_10amq.src.rpm qpid-proton-0.32.0-1.el6_10.src.rpm

7Client-AMQ-Clients-2:

Source: qpid-cpp-1.36.0-31.el7amq.src.rpm qpid-proton-0.32.0-2.el7.src.rpm

noarch: python-qpid-proton-docs-0.32.0-2.el7.noarch.rpm qpid-cpp-client-docs-1.36.0-31.el7amq.noarch.rpm qpid-proton-c-docs-0.32.0-2.el7.noarch.rpm qpid-proton-cpp-docs-0.32.0-2.el7.noarch.rpm qpid-proton-tests-0.32.0-2.el7.noarch.rpm

x86_64: python-qpid-proton-0.32.0-2.el7.x86_64.rpm qpid-cpp-client-1.36.0-31.el7amq.x86_64.rpm qpid-cpp-client-devel-1.36.0-31.el7amq.x86_64.rpm qpid-cpp-debuginfo-1.36.0-31.el7amq.x86_64.rpm qpid-proton-c-0.32.0-2.el7.x86_64.rpm qpid-proton-c-devel-0.32.0-2.el7.x86_64.rpm qpid-proton-cpp-0.32.0-2.el7.x86_64.rpm qpid-proton-cpp-devel-0.32.0-2.el7.x86_64.rpm qpid-proton-debuginfo-0.32.0-2.el7.x86_64.rpm rubygem-qpid_proton-0.32.0-2.el7.x86_64.rpm

7ComputeNode-AMQ-Clients-2:

Source: qpid-cpp-1.36.0-31.el7amq.src.rpm qpid-proton-0.32.0-2.el7.src.rpm

7Server-AMQ-Clients-2:

Source: qpid-cpp-1.36.0-31.el7amq.src.rpm qpid-proton-0.32.0-2.el7.src.rpm

7Workstation-AMQ-Clients-2:

Source: qpid-cpp-1.36.0-31.el7amq.src.rpm qpid-proton-0.32.0-2.el7.src.rpm

8Base-AMQ-Clients-2:

Source: nodejs-rhea-1.0.24-1.el8.src.rpm qpid-proton-0.32.0-2.el8.src.rpm

noarch: nodejs-rhea-1.0.24-1.el8.noarch.rpm python-qpid-proton-docs-0.32.0-2.el8.noarch.rpm qpid-proton-c-docs-0.32.0-2.el8.noarch.rpm qpid-proton-cpp-docs-0.32.0-2.el8.noarch.rpm qpid-proton-tests-0.32.0-2.el8.noarch.rpm

x86_64: python3-qpid-proton-0.32.0-2.el8.x86_64.rpm python3-qpid-proton-debuginfo-0.32.0-2.el8.x86_64.rpm qpid-proton-c-0.32.0-2.el8.x86_64.rpm qpid-proton-c-debuginfo-0.32.0-2.el8.x86_64.rpm qpid-proton-c-devel-0.32.0-2.el8.x86_64.rpm qpid-proton-cpp-0.32.0-2.el8.x86_64.rpm qpid-proton-cpp-debuginfo-0.32.0-2.el8.x86_64.rpm qpid-proton-cpp-devel-0.32.0-2.el8.x86_64.rpm qpid-proton-debuginfo-0.32.0-2.el8.x86_64.rpm qpid-proton-debugsource-0.32.0-2.el8.x86_64.rpm rubygem-qpid_proton-0.32.0-2.el8.x86_64.rpm rubygem-qpid_proton-debuginfo-0.32.0-2.el8.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202003-1785",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "ucosminexus application server",
        "scope": null,
        "trust": 1.6,
        "vendor": "\u65e5\u7acb",
        "version": null
      },
      {
        "model": "ucosminexus service platform",
        "scope": null,
        "trust": 1.6,
        "vendor": "\u65e5\u7acb",
        "version": null
      },
      {
        "model": "communications network charging and control",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.0.3"
      },
      {
        "model": "communications session route manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.2.0"
      },
      {
        "model": "financial services analytical applications infrastructure",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.0.6"
      },
      {
        "model": "primavera unifier",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "17.12"
      },
      {
        "model": "primavera unifier",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.1"
      },
      {
        "model": "retail xstore point of service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "webcenter portal",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.3.0"
      },
      {
        "model": "webcenter portal",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.4.0"
      },
      {
        "model": "financial services analytical applications infrastructure",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.1.0"
      },
      {
        "model": "jd edwards enterpriseone tools",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "9.2.4.2"
      },
      {
        "model": "communications evolved communications application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.1"
      },
      {
        "model": "communications session route manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.2.2"
      },
      {
        "model": "retail sales audit",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "retail xstore point of service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "19.0"
      },
      {
        "model": "retail xstore point of service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "18.0"
      },
      {
        "model": "financial services institutional performance analytics",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.0.6"
      },
      {
        "model": "insurance policy administration j2ee",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.1.0.15"
      },
      {
        "model": "banking digital experience",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "18.1"
      },
      {
        "model": "global lifecycle management opatch",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.0.1.20"
      },
      {
        "model": "retail merchandising system",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "financial services price creation and discovery",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.0.7"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "8.0"
      },
      {
        "model": "banking platform",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "2.9.0"
      },
      {
        "model": "banking digital experience",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "20.1"
      },
      {
        "model": "jackson-databind",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fasterxml",
        "version": "2.9.10.4"
      },
      {
        "model": "communications session report manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.2.0"
      },
      {
        "model": "communications instant messaging server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.0.1.4.0"
      },
      {
        "model": "banking digital experience",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "18.2"
      },
      {
        "model": "steelstore cloud integrated storage",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "communications session report manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.2.2"
      },
      {
        "model": "jd edwards enterpriseone orchestrator",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "9.2.4.2"
      },
      {
        "model": "primavera unifier",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.2"
      },
      {
        "model": "primavera unifier",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "18.8"
      },
      {
        "model": "retail service backbone",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "retail xstore point of service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "enterprise manager base platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.4.0.0"
      },
      {
        "model": "communications element manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.2.0"
      },
      {
        "model": "financial services institutional performance analytics",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.1.0"
      },
      {
        "model": "communications element manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.2.2"
      },
      {
        "model": "insurance policy administration j2ee",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.0.2.25"
      },
      {
        "model": "agile plm",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "9.3.6"
      },
      {
        "model": "banking digital experience",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "19.2"
      },
      {
        "model": "communications contacts server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.0.0.5.0"
      },
      {
        "model": "primavera unifier",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "17.7"
      },
      {
        "model": "autovue for agile product lifecycle management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "21.0.2"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.3.0"
      },
      {
        "model": "primavera unifier",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "19.12"
      },
      {
        "model": "retail xstore point of service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "17.0"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.4.0"
      },
      {
        "model": "financial services price creation and discovery",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.0.6"
      },
      {
        "model": "banking digital experience",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "19.1"
      },
      {
        "model": "communications network charging and control",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "6.0.1"
      },
      {
        "model": "retail service backbone",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "communications diameter signaling router",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.2.2"
      },
      {
        "model": "enterprise manager base platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.3.0.0"
      },
      {
        "model": "retail service backbone",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "financial services retail customer analytics",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.0.6"
      },
      {
        "model": "financial services institutional performance analytics",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.0.7"
      },
      {
        "model": "communications diameter signaling router",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.0.0"
      },
      {
        "model": "jackson-databind",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "fasterxml",
        "version": "2.9.0"
      },
      {
        "model": "communications calendar server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.0.0.4.0"
      },
      {
        "model": "banking platform",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "2.4.0"
      },
      {
        "model": "banking digital experience",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "18.3"
      },
      {
        "model": "communications network charging and control",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.0.0"
      },
      {
        "model": "ucosminexus service architect",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u65e5\u7acb",
        "version": null
      },
      {
        "model": "ucosminexus application server-r",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u65e5\u7acb",
        "version": null
      },
      {
        "model": "ucosminexus developer",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u65e5\u7acb",
        "version": null
      },
      {
        "model": "jackson-databind",
        "scope": null,
        "trust": 0.8,
        "vendor": "fasterxml",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003617"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-11113"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Red Hat",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "158650"
      },
      {
        "db": "PACKETSTORM",
        "id": "157741"
      },
      {
        "db": "PACKETSTORM",
        "id": "160601"
      },
      {
        "db": "PACKETSTORM",
        "id": "157859"
      },
      {
        "db": "PACKETSTORM",
        "id": "158651"
      },
      {
        "db": "PACKETSTORM",
        "id": "159208"
      },
      {
        "db": "PACKETSTORM",
        "id": "158636"
      },
      {
        "db": "PACKETSTORM",
        "id": "159271"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1735"
      }
    ],
    "trust": 1.4
  },
  "cve": "CVE-2020-11113",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "CVE-2020-11113",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "VHN-163659",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "id": "CVE-2020-11113",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 2.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 8.8,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2020-11113",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2020-11113",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "id": "CVE-2020-11113",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2020-11113",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202003-1735",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-163659",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2020-11113",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-163659"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-11113"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003617"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1735"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-11113"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-11113"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa). FasterXML jackson-databind contains an untrusted data deserialization vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. FasterXML Jackson is a data processing tool for Java developed by American FasterXML Company. jackson-databind is one of the components with data binding function. A security vulnerability exists in FasterXML jackson-databind 2.x versions prior to 2.9.10.4. Currently there is no information about this vulnerability, please keep an eye on CNNVD or vendor announcements. Description:\n\nRed Hat Decision Manager is an open source decision management platform\nthat combines business rules management, complex event processing, Decision\nModel \u0026 Notation (DMN) execution, and Business Optimizer for solving\nplanning problems. It automates business decisions and makes that logic\navailable to the entire business. \n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update; after installing the update,\nrestart the server by starting the JBoss Application Server process. \n\nSecurity Fix(es):\n\n* apache-commons-beanutils: does not suppresses the class property in\nPropertyUtilsBean by default (CVE-2019-10086)\n\n* cxf: does not restrict the number of message attachments (CVE-2019-12406)\n\n* cxf: OpenId Connect token service does not properly validate the clientId\n(CVE-2019-12419)\n\n* hibernate-validator: safeHTML validator allows XSS (CVE-2019-10219)\n\n* HTTP/2: flood using PING frames results in unbounded memory growth\n(CVE-2019-9512)\n\n* HTTP/2: flood using HEADERS frames results in unbounded memory growth\n(CVE-2019-9514)\n\n* HTTP/2: flood using SETTINGS frames results in unbounded memory growth\n(CVE-2019-9515)\n\n* HTTP/2: large amount of data requests leads to denial of service\n(CVE-2019-9511)\n\n* jackson-databind: Multiple serialization gadgets (CVE-2019-17531,\nCVE-2019-16943, CVE-2019-16942, CVE-2019-17267, CVE-2019-14540,\nCVE-2019-16335, CVE-2019-14893, CVE-2019-14892, CVE-2020-9546,\nCVE-2020-9547, CVE-2020-9548, CVE-2020-10969, CVE-2020-10968,\nCVE-2020-11111, CVE-2020-11112, CVE-2020-11113, CVE-2020-11619,\nCVE-2020-11620, CVE-2019-20330, CVE-2020-8840)\n\n* jackson-databind: mishandles the interaction between serialization\ngadgets and typing which could result in remote command \nexecution (CVE-2020-10672, CVE-2020-10673)\n\n* keycloak: adapter endpoints are exposed via arbitrary URLs\n(CVE-2019-14820)\n\n* keycloak: missing signatures validation on CRL used to verify client\ncertificates (CVE-2019-3875)\n\n* keycloak: SAML broker does not check existence of signature on document\nallowing any user impersonation (CVE-2019-10201)\n\n* keycloak: CSRF check missing in My Resources functionality in the Account\nConsole (CVE-2019-10199)\n\n* keycloak: cross-realm user access auth bypass (CVE-2019-14832)\n\n* netty: HTTP Request Smuggling due to Transfer-Encoding whitespace\nmishandling (CVE-2020-7238)\n\n* SmallRye: SecuritySupport class is incorrectly public and contains a\nstatic method to access the current threads context class loader\n(CVE-2020-1729)\n\n* thrift: Out-of-bounds read related to TJSONProtocol or\nTSimpleJSONProtocol (CVE-2019-0210)\n\n* thrift: Endless loop when feed with specific input data (CVE-2019-0205)\n\n* undertow: possible Denial Of Service (DOS) in Undertow HTTP server\nlistening on HTTPS (CVE-2019-14888)\n\n* wildfly: The \u0027enabled-protocols\u0027 value in legacy security is not\nrespected if OpenSSL security provider is in use (CVE-2019-14887)\n\n* wildfly-core: Incorrect privileges for \u0027Monitor\u0027, \u0027Auditor\u0027 and\n\u0027Deployer\u0027 user by default (CVE-2019-14838)\n\n* xml-security: Apache Santuario potentially loads XML parsing code from an\nuntrusted source (CVE-2019-12400)\n\nFor more details about the security issues and their impact, the CVSS\nscore, acknowledgements, and other related information, see the CVE pages\nlisted in the References section. You must be logged in to download the update. \n\nNOTE: This advisory is an addendum to\nhttps://access.redhat.com/errata/RHBA-2020:1414 and is an informational\nadvisory only, to clarify security fixes released therein. No code has been\nmodified as part of this advisory. Description:\n\nRed Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak\nproject, that provides authentication and standards-based single sign-on\ncapabilities for web and mobile applications. Bugs fixed (https://bugzilla.redhat.com/):\n\n1800573 - CVE-2020-1727 keycloak: missing input validation in IDP authorization URLs\n1819208 - CVE-2020-10968 jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider\n1821304 - CVE-2020-11111 jackson-databind: Serialization gadgets in org.apache.activemq.jms.pool.XaPooledConnectionFactory\n1821311 - CVE-2020-11112 jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider\n1821315 - CVE-2020-11113 jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime\n1826798 - CVE-2020-11620 jackson-databind: Serialization gadgets in commons-jelly:commons-jelly\n1826805 - CVE-2020-11619 jackson-databind: Serialization gadgets in org.springframework:spring-aop\n\n5. Summary:\n\nThis is a security update for JBoss EAP Continuous Delivery 19. JIRA issues fixed (https://issues.jboss.org/):\n\nJBEAP-18881 - Upgrade Undertow to 2.0.30.SP1\nJBEAP-18974 - Upgrade snakeyaml to 1.26\nJBEAP-18975 - Upgrade cryptacular to 1.2.4\nJBEAP-18982 - Upgrade WildFly Core to 11.0.0.Final-redhat-00001\nJBEAP-18983 - Upgrade Remoting JMX from 3.0.3 to 3.0.4\nJBEAP-19041 - Upgrade WildFly Elytron to 1.11.3.Final\nJBEAP-19042 - Upgrade wildfly-core to 11.0.2.Final\nJBEAP-19076 - Upgrade resteasy from 3.11.0.Final to 3.11.1.Final\nJBEAP-19211 - Empty section Fixed CVEs in CD19 Release Notes\n\n6. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n====================================================================                   \nRed Hat Security Advisory\n\nSynopsis:          Important: Red Hat Data Grid 7.3.7 security update\nAdvisory ID:       RHSA-2020:3779-01\nProduct:           Red Hat JBoss Data Grid\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2020:3779\nIssue date:        2020-09-17\nCVE Names:         CVE-2017-7658 CVE-2019-10172 CVE-2020-1695\n                   CVE-2020-1710 CVE-2020-1719 CVE-2020-1745\n                   CVE-2020-1748 CVE-2020-1757 CVE-2020-8840\n                   CVE-2020-9488 CVE-2020-9546 CVE-2020-9547\n                   CVE-2020-9548 CVE-2020-10672 CVE-2020-10673\n                   CVE-2020-10714 CVE-2020-10968 CVE-2020-10969\n                   CVE-2020-11111 CVE-2020-11112 CVE-2020-11113\n                   CVE-2020-11612 CVE-2020-11619 CVE-2020-11620\n====================================================================\n1. Summary:\n\nAn update for Red Hat Data Grid is now available. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Description:\n\nRed Hat Data Grid is a distributed, in-memory, NoSQL datastore based on the\nInfinispan project. \n\nThis release of Red Hat Data Grid 7.3.7 serves as a replacement for Red Hat\nData Grid 7.3.6 and includes bug fixes and enhancements, which are\ndescribed in the Release Notes, linked to in the References section of this\nerratum. \n\nSecurity Fix(es):\n\n* jetty: Incorrect header handling (CVE-2017-7658)\n\n* EAP: field-name is not parsed in accordance to RFC7230 (CVE-2020-1710)\n\n* undertow: AJP File Read/Inclusion Vulnerability (CVE-2020-1745)\n\n* undertow: servletPath is normalized incorrectly leading to dangerous\napplication mapping which could result in security bypass (CVE-2020-1757)\n\n* jackson-databind: Lacks certain xbean-reflect/JNDI blocking\n(CVE-2020-8840)\n\n* jackson-databind: Serialization gadgets in shaded-hikari-config\n(CVE-2020-9546)\n\n* jackson-databind: Serialization gadgets in ibatis-sqlmap (CVE-2020-9547)\n\n* jackson-databind: Serialization gadgets in anteros-core (CVE-2020-9548)\n\n* jackson-databind: mishandles the interaction between serialization\ngadgets and typing which could result in remote command execution\n(CVE-2020-10672)\n\n* jackson-databind: mishandles the interaction between serialization\ngadgets and typing which could result in remote command execution\n(CVE-2020-10673)\n\n* jackson-databind: Serialization gadgets in\norg.aoju.bus.proxy.provider.*.RmiProvider (CVE-2020-10968)\n\n* jackson-databind: Serialization gadgets in javax.swing.JEditorPane\n(CVE-2020-10969)\n\n* jackson-databind: Serialization gadgets in\norg.apache.activemq.jms.pool.XaPooledConnectionFactory (CVE-2020-11111)\n\n* jackson-databind: Serialization gadgets in\norg.apache.commons.proxy.provider.remoting.RmiProvider (CVE-2020-11112)\n\n* jackson-databind: Serialization gadgets in\norg.apache.openjpa.ee.WASRegistryManagedRuntime (CVE-2020-11113)\n\n* jackson-databind: Serialization gadgets in org.springframework:spring-aop\n(CVE-2020-11619)\n\n* jackson-databind: Serialization gadgets in commons-jelly:commons-jelly\n(CVE-2020-11620)\n\n* jackson-mapper-asl: XML external entity similar to CVE-2016-3720\n(CVE-2019-10172)\n\n* resteasy: Improper validation of response header in\nMediaTypeHeaderDelegate.java class (CVE-2020-1695)\n\n* Wildfly: EJBContext principal is not popped back after invoking another\nEJB using a different Security Domain (CVE-2020-1719)\n\n* Wildfly: Improper authorization issue in WildFlySecurityManager when\nusing alternative protection domain (CVE-2020-1748)\n\n* wildfly-elytron: session fixation when using FORM authentication\n(CVE-2020-10714)\n\n* netty: compression/decompression codecs don\u0027t enforce limits on buffer\nallocation sizes (CVE-2020-11612)\n\n* log4j: improper validation of certificate with host mismatch in SMTP\nappender (CVE-2020-9488)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\n3. Solution:\n\nTo install this update, do the following:\n\n1. Download the Data Grid 7.3.7 server patch from the customer portal. See\nthe download link in the References section. \n2. Back up your existing Data Grid installation. You should back up\ndatabases, configuration files, and so on. \n3. Install the Data Grid 7.3.7 server patch. Refer to the 7.3 Release Notes\nfor patching instructions. \n4. Restart Data Grid to ensure the changes take effect. \n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1595621 - CVE-2017-7658 jetty: Incorrect header handling\n1715075 - CVE-2019-10172 jackson-mapper-asl: XML external entity similar to CVE-2016-3720\n1730462 - CVE-2020-1695 resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class\n1752770 - CVE-2020-1757 undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass\n1793970 - CVE-2020-1710 EAP: field-name is not parsed in accordance to RFC7230\n1796617 - CVE-2020-1719 Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain\n1807305 - CVE-2020-1745 undertow: AJP File Read/Inclusion Vulnerability\n1807707 - CVE-2020-1748 Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain\n1815470 - CVE-2020-10673 jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution\n1815495 - CVE-2020-10672 jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution\n1816216 - CVE-2020-11612 netty: compression/decompression codecs don\u0027t enforce limits on buffer allocation sizes\n1816330 - CVE-2020-8840 jackson-databind: Lacks certain xbean-reflect/JNDI blocking\n1816332 - CVE-2020-9546 jackson-databind: Serialization gadgets in shaded-hikari-config\n1816337 - CVE-2020-9547 jackson-databind: Serialization gadgets in ibatis-sqlmap\n1816340 - CVE-2020-9548 jackson-databind: Serialization gadgets in anteros-core\n1819208 - CVE-2020-10968 jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider\n1819212 - CVE-2020-10969 jackson-databind: Serialization gadgets in javax.swing.JEditorPane\n1821304 - CVE-2020-11111 jackson-databind: Serialization gadgets in org.apache.activemq.jms.pool.XaPooledConnectionFactory\n1821311 - CVE-2020-11112 jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider\n1821315 - CVE-2020-11113 jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime\n1825714 - CVE-2020-10714 wildfly-elytron: session fixation when using FORM authentication\n1826798 - CVE-2020-11620 jackson-databind: Serialization gadgets in commons-jelly:commons-jelly\n1826805 - CVE-2020-11619 jackson-databind: Serialization gadgets in org.springframework:spring-aop\n1831139 - CVE-2020-9488 log4j: improper validation of certificate with host mismatch in SMTP appender\n\n5. References:\n\nhttps://access.redhat.com/security/cve/CVE-2017-7658\nhttps://access.redhat.com/security/cve/CVE-2019-10172\nhttps://access.redhat.com/security/cve/CVE-2020-1695\nhttps://access.redhat.com/security/cve/CVE-2020-1710\nhttps://access.redhat.com/security/cve/CVE-2020-1719\nhttps://access.redhat.com/security/cve/CVE-2020-1745\nhttps://access.redhat.com/security/cve/CVE-2020-1748\nhttps://access.redhat.com/security/cve/CVE-2020-1757\nhttps://access.redhat.com/security/cve/CVE-2020-8840\nhttps://access.redhat.com/security/cve/CVE-2020-9488\nhttps://access.redhat.com/security/cve/CVE-2020-9546\nhttps://access.redhat.com/security/cve/CVE-2020-9547\nhttps://access.redhat.com/security/cve/CVE-2020-9548\nhttps://access.redhat.com/security/cve/CVE-2020-10672\nhttps://access.redhat.com/security/cve/CVE-2020-10673\nhttps://access.redhat.com/security/cve/CVE-2020-10714\nhttps://access.redhat.com/security/cve/CVE-2020-10968\nhttps://access.redhat.com/security/cve/CVE-2020-10969\nhttps://access.redhat.com/security/cve/CVE-2020-11111\nhttps://access.redhat.com/security/cve/CVE-2020-11112\nhttps://access.redhat.com/security/cve/CVE-2020-11113\nhttps://access.redhat.com/security/cve/CVE-2020-11612\nhttps://access.redhat.com/security/cve/CVE-2020-11619\nhttps://access.redhat.com/security/cve/CVE-2020-11620\nhttps://access.redhat.com/security/updates/classification/#important\nhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product\\xdata.grid\u0026downloadType=securityPatches\u0026version=7.3\nhttps://access.redhat.com/documentation/en-us/red_hat_data_grid/7.3/html/red_hat_data_grid_7.3_release_notes/index\n\n6. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2020 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBX2Nf/dzjgjWX9erEAQifjA/7BlSA2KK7e4RlxfRAP3Sj7xT+CRlFcOJn\nNVVI6DNpfZNtD/TJ4M5JFMP/yzKb+/FoaGVUexqiUxQBcrYsViZdfwfQ6PSwQgd8\n5GAtC0NINGYmr0y7m6sKbAwAofnmCoEjNPjpdfLG632Err4vXDT9pGx1RNIrfS0A\nqaOSuf2BjZkD9A6Azroupq/ePmRnDBW4ovWF4ES415Pa5T7N4rmoyZ3UnGrbubmm\nGisjzhBbFyjL2wM1gMtqKlf5Qdre0XQIio4YLEnK1DaS7qLS36L04UJP9rwtB/nn\naCOKZE/4Ch0gYcNlwniH4MK4Aiy/z/OGQopuhJoKFADJ3Y5lnJwCWDMjMKwWSj1G\nDvKG4uSIa8l2oxGQURThwxY1Jr7sbQTy2QXCVoyZj9oOKoGel+qJaGVFVnwsOpB7\nMB8nPAuINZ91RR7xSBLv/AyoLnXV3dI97kOyTwEhld6THIwAUWqk+V2y7M6Onlx9\nPf+whfe0ORHzeCj/UBZh2NqcuShUpjdE9aLyYyefa2VV4t+0L4XlIfnlNuL8Ja7j\nwzLJlo/u8XMktoXRrBpMWZaCzcqN1+BTuQUXNZeqfNtgFmCgJVxp6tHyHni7flQq\nP2M8FaCyQHyQ1ggSljgZ66AEdiwatYpqOxR4yUyrKmsXt9iPsX45TdA9zSKmF2Sb\nPyKX8lLP6w8=n+2X\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. \nThe purpose of this text-only errata is to inform you about the security\nissues fixed in this release. \n\nInstallation instructions are available from the Fuse 7.7.0 product\ndocumentation page:\nhttps://access.redhat.com/documentation/en-us/red_hat_fuse/7.7/\n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1343616 - CVE-2016-4970 netty: Infinite loop vulnerability when handling renegotiation using SslProvider.OpenSsl\n1620529 - CVE-2018-1000632 dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents\n1632452 - CVE-2018-3831 elasticsearch: Information exposure via _cluster/settings API\n1637492 - CVE-2018-11797 pdfbox: unbounded computation in parser resulting in a denial of service\n1638391 - CVE-2018-12541 vertx: WebSocket HTTP upgrade implementation holds the entire http request in memory before the handshake\n1697598 - CVE-2019-3797 spring-data-jpa: Additional information exposure with Spring Data JPA derived queries\n1700016 - CVE-2019-0231 mina-core: Retaining an open socket in close_notify SSL-TLS leading to Information disclosure. \n1713468 - CVE-2019-12086 jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server. Relevant releases/architectures:\n\n6Client-AMQ-Clients-2 - i386, noarch, x86_64\n6ComputeNode-AMQ-Clients-2 - noarch, x86_64\n6Server-AMQ-Clients-2 - i386, noarch, x86_64\n6Workstation-AMQ-Clients-2 - i386, noarch, x86_64\n7Client-AMQ-Clients-2 - noarch, x86_64\n7ComputeNode-AMQ-Clients-2 - noarch, x86_64\n7Server-AMQ-Clients-2 - noarch, x86_64\n7Workstation-AMQ-Clients-2 - noarch, x86_64\n8Base-AMQ-Clients-2 - noarch, x86_64\n\n3. Description:\n\nRed Hat AMQ Clients enable connecting, sending, and receiving messages over\nthe AMQP 1.0 wire transport protocol to or from AMQ Broker 6 and 7. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. \n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1821315 - CVE-2020-11113 jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime\n1831139 - CVE-2020-9488 log4j: improper validation of certificate with host mismatch in SMTP appender\n1851327 - CVE-2020-14307 wildfly: EJB SessionOpenInvocations may not be removed properly after a response is received causing Denial of Service\n1853595 - CVE-2020-14297 wildfly: Some EJB transaction objects may get accumulated causing Denial of Service\n\n6. JIRA issues fixed (https://issues.jboss.org/):\n\nENTMQCL-1987 - AMQ Resource Adapter example project is incompatible with Maven 3.6\nENTMQCL-1988 - AMQ Resource Adapter example project does not run\nENTMQCL-2070 - [jms] Log successful reconnects more prominently\n\n7. Package List:\n\n6Client-AMQ-Clients-2:\n\nSource:\nqpid-cpp-1.36.0-31.el6_10amq.src.rpm\nqpid-proton-0.32.0-1.el6_10.src.rpm\n\ni386:\npython-qpid-proton-0.32.0-1.el6_10.i686.rpm\nqpid-proton-c-0.32.0-1.el6_10.i686.rpm\nqpid-proton-c-devel-0.32.0-1.el6_10.i686.rpm\nqpid-proton-cpp-0.32.0-1.el6_10.i686.rpm\nqpid-proton-cpp-devel-0.32.0-1.el6_10.i686.rpm\nqpid-proton-debuginfo-0.32.0-1.el6_10.i686.rpm\n\nnoarch:\npython-qpid-proton-docs-0.32.0-1.el6_10.noarch.rpm\nqpid-cpp-client-docs-1.36.0-31.el6_10amq.noarch.rpm\nqpid-proton-c-docs-0.32.0-1.el6_10.noarch.rpm\nqpid-proton-cpp-docs-0.32.0-1.el6_10.noarch.rpm\nqpid-proton-tests-0.32.0-1.el6_10.noarch.rpm\n\nx86_64:\npython-qpid-proton-0.32.0-1.el6_10.x86_64.rpm\nqpid-cpp-client-1.36.0-31.el6_10amq.x86_64.rpm\nqpid-cpp-client-devel-1.36.0-31.el6_10amq.x86_64.rpm\nqpid-cpp-debuginfo-1.36.0-31.el6_10amq.x86_64.rpm\nqpid-proton-c-0.32.0-1.el6_10.x86_64.rpm\nqpid-proton-c-devel-0.32.0-1.el6_10.x86_64.rpm\nqpid-proton-cpp-0.32.0-1.el6_10.x86_64.rpm\nqpid-proton-cpp-devel-0.32.0-1.el6_10.x86_64.rpm\nqpid-proton-debuginfo-0.32.0-1.el6_10.x86_64.rpm\n\n6ComputeNode-AMQ-Clients-2:\n\nSource:\nqpid-cpp-1.36.0-31.el6_10amq.src.rpm\nqpid-proton-0.32.0-1.el6_10.src.rpm\n\nnoarch:\npython-qpid-proton-docs-0.32.0-1.el6_10.noarch.rpm\nqpid-cpp-client-docs-1.36.0-31.el6_10amq.noarch.rpm\nqpid-proton-c-docs-0.32.0-1.el6_10.noarch.rpm\nqpid-proton-cpp-docs-0.32.0-1.el6_10.noarch.rpm\nqpid-proton-tests-0.32.0-1.el6_10.noarch.rpm\n\nx86_64:\npython-qpid-proton-0.32.0-1.el6_10.x86_64.rpm\nqpid-cpp-client-1.36.0-31.el6_10amq.x86_64.rpm\nqpid-cpp-client-devel-1.36.0-31.el6_10amq.x86_64.rpm\nqpid-cpp-debuginfo-1.36.0-31.el6_10amq.x86_64.rpm\nqpid-proton-c-0.32.0-1.el6_10.x86_64.rpm\nqpid-proton-c-devel-0.32.0-1.el6_10.x86_64.rpm\nqpid-proton-cpp-0.32.0-1.el6_10.x86_64.rpm\nqpid-proton-cpp-devel-0.32.0-1.el6_10.x86_64.rpm\nqpid-proton-debuginfo-0.32.0-1.el6_10.x86_64.rpm\n\n6Server-AMQ-Clients-2:\n\nSource:\nqpid-cpp-1.36.0-31.el6_10amq.src.rpm\nqpid-proton-0.32.0-1.el6_10.src.rpm\n\ni386:\npython-qpid-proton-0.32.0-1.el6_10.i686.rpm\nqpid-proton-c-0.32.0-1.el6_10.i686.rpm\nqpid-proton-c-devel-0.32.0-1.el6_10.i686.rpm\nqpid-proton-cpp-0.32.0-1.el6_10.i686.rpm\nqpid-proton-cpp-devel-0.32.0-1.el6_10.i686.rpm\nqpid-proton-debuginfo-0.32.0-1.el6_10.i686.rpm\n\nnoarch:\npython-qpid-proton-docs-0.32.0-1.el6_10.noarch.rpm\nqpid-cpp-client-docs-1.36.0-31.el6_10amq.noarch.rpm\nqpid-proton-c-docs-0.32.0-1.el6_10.noarch.rpm\nqpid-proton-cpp-docs-0.32.0-1.el6_10.noarch.rpm\nqpid-proton-tests-0.32.0-1.el6_10.noarch.rpm\n\nx86_64:\npython-qpid-proton-0.32.0-1.el6_10.x86_64.rpm\nqpid-cpp-client-1.36.0-31.el6_10amq.x86_64.rpm\nqpid-cpp-client-devel-1.36.0-31.el6_10amq.x86_64.rpm\nqpid-cpp-debuginfo-1.36.0-31.el6_10amq.x86_64.rpm\nqpid-proton-c-0.32.0-1.el6_10.x86_64.rpm\nqpid-proton-c-devel-0.32.0-1.el6_10.x86_64.rpm\nqpid-proton-cpp-0.32.0-1.el6_10.x86_64.rpm\nqpid-proton-cpp-devel-0.32.0-1.el6_10.x86_64.rpm\nqpid-proton-debuginfo-0.32.0-1.el6_10.x86_64.rpm\n\n6Workstation-AMQ-Clients-2:\n\nSource:\nqpid-cpp-1.36.0-31.el6_10amq.src.rpm\nqpid-proton-0.32.0-1.el6_10.src.rpm\n\ni386:\npython-qpid-proton-0.32.0-1.el6_10.i686.rpm\nqpid-proton-c-0.32.0-1.el6_10.i686.rpm\nqpid-proton-c-devel-0.32.0-1.el6_10.i686.rpm\nqpid-proton-cpp-0.32.0-1.el6_10.i686.rpm\nqpid-proton-cpp-devel-0.32.0-1.el6_10.i686.rpm\nqpid-proton-debuginfo-0.32.0-1.el6_10.i686.rpm\n\nnoarch:\npython-qpid-proton-docs-0.32.0-1.el6_10.noarch.rpm\nqpid-cpp-client-docs-1.36.0-31.el6_10amq.noarch.rpm\nqpid-proton-c-docs-0.32.0-1.el6_10.noarch.rpm\nqpid-proton-cpp-docs-0.32.0-1.el6_10.noarch.rpm\nqpid-proton-tests-0.32.0-1.el6_10.noarch.rpm\n\nx86_64:\npython-qpid-proton-0.32.0-1.el6_10.x86_64.rpm\nqpid-cpp-client-1.36.0-31.el6_10amq.x86_64.rpm\nqpid-cpp-client-devel-1.36.0-31.el6_10amq.x86_64.rpm\nqpid-cpp-debuginfo-1.36.0-31.el6_10amq.x86_64.rpm\nqpid-proton-c-0.32.0-1.el6_10.x86_64.rpm\nqpid-proton-c-devel-0.32.0-1.el6_10.x86_64.rpm\nqpid-proton-cpp-0.32.0-1.el6_10.x86_64.rpm\nqpid-proton-cpp-devel-0.32.0-1.el6_10.x86_64.rpm\nqpid-proton-debuginfo-0.32.0-1.el6_10.x86_64.rpm\n\n7Client-AMQ-Clients-2:\n\nSource:\nqpid-cpp-1.36.0-31.el7amq.src.rpm\nqpid-proton-0.32.0-2.el7.src.rpm\n\nnoarch:\npython-qpid-proton-docs-0.32.0-2.el7.noarch.rpm\nqpid-cpp-client-docs-1.36.0-31.el7amq.noarch.rpm\nqpid-proton-c-docs-0.32.0-2.el7.noarch.rpm\nqpid-proton-cpp-docs-0.32.0-2.el7.noarch.rpm\nqpid-proton-tests-0.32.0-2.el7.noarch.rpm\n\nx86_64:\npython-qpid-proton-0.32.0-2.el7.x86_64.rpm\nqpid-cpp-client-1.36.0-31.el7amq.x86_64.rpm\nqpid-cpp-client-devel-1.36.0-31.el7amq.x86_64.rpm\nqpid-cpp-debuginfo-1.36.0-31.el7amq.x86_64.rpm\nqpid-proton-c-0.32.0-2.el7.x86_64.rpm\nqpid-proton-c-devel-0.32.0-2.el7.x86_64.rpm\nqpid-proton-cpp-0.32.0-2.el7.x86_64.rpm\nqpid-proton-cpp-devel-0.32.0-2.el7.x86_64.rpm\nqpid-proton-debuginfo-0.32.0-2.el7.x86_64.rpm\nrubygem-qpid_proton-0.32.0-2.el7.x86_64.rpm\n\n7ComputeNode-AMQ-Clients-2:\n\nSource:\nqpid-cpp-1.36.0-31.el7amq.src.rpm\nqpid-proton-0.32.0-2.el7.src.rpm\n\nnoarch:\npython-qpid-proton-docs-0.32.0-2.el7.noarch.rpm\nqpid-cpp-client-docs-1.36.0-31.el7amq.noarch.rpm\nqpid-proton-c-docs-0.32.0-2.el7.noarch.rpm\nqpid-proton-cpp-docs-0.32.0-2.el7.noarch.rpm\nqpid-proton-tests-0.32.0-2.el7.noarch.rpm\n\nx86_64:\npython-qpid-proton-0.32.0-2.el7.x86_64.rpm\nqpid-cpp-client-1.36.0-31.el7amq.x86_64.rpm\nqpid-cpp-client-devel-1.36.0-31.el7amq.x86_64.rpm\nqpid-cpp-debuginfo-1.36.0-31.el7amq.x86_64.rpm\nqpid-proton-c-0.32.0-2.el7.x86_64.rpm\nqpid-proton-c-devel-0.32.0-2.el7.x86_64.rpm\nqpid-proton-cpp-0.32.0-2.el7.x86_64.rpm\nqpid-proton-cpp-devel-0.32.0-2.el7.x86_64.rpm\nqpid-proton-debuginfo-0.32.0-2.el7.x86_64.rpm\nrubygem-qpid_proton-0.32.0-2.el7.x86_64.rpm\n\n7Server-AMQ-Clients-2:\n\nSource:\nqpid-cpp-1.36.0-31.el7amq.src.rpm\nqpid-proton-0.32.0-2.el7.src.rpm\n\nnoarch:\npython-qpid-proton-docs-0.32.0-2.el7.noarch.rpm\nqpid-cpp-client-docs-1.36.0-31.el7amq.noarch.rpm\nqpid-proton-c-docs-0.32.0-2.el7.noarch.rpm\nqpid-proton-cpp-docs-0.32.0-2.el7.noarch.rpm\nqpid-proton-tests-0.32.0-2.el7.noarch.rpm\n\nx86_64:\npython-qpid-proton-0.32.0-2.el7.x86_64.rpm\nqpid-cpp-client-1.36.0-31.el7amq.x86_64.rpm\nqpid-cpp-client-devel-1.36.0-31.el7amq.x86_64.rpm\nqpid-cpp-debuginfo-1.36.0-31.el7amq.x86_64.rpm\nqpid-proton-c-0.32.0-2.el7.x86_64.rpm\nqpid-proton-c-devel-0.32.0-2.el7.x86_64.rpm\nqpid-proton-cpp-0.32.0-2.el7.x86_64.rpm\nqpid-proton-cpp-devel-0.32.0-2.el7.x86_64.rpm\nqpid-proton-debuginfo-0.32.0-2.el7.x86_64.rpm\nrubygem-qpid_proton-0.32.0-2.el7.x86_64.rpm\n\n7Workstation-AMQ-Clients-2:\n\nSource:\nqpid-cpp-1.36.0-31.el7amq.src.rpm\nqpid-proton-0.32.0-2.el7.src.rpm\n\nnoarch:\npython-qpid-proton-docs-0.32.0-2.el7.noarch.rpm\nqpid-cpp-client-docs-1.36.0-31.el7amq.noarch.rpm\nqpid-proton-c-docs-0.32.0-2.el7.noarch.rpm\nqpid-proton-cpp-docs-0.32.0-2.el7.noarch.rpm\nqpid-proton-tests-0.32.0-2.el7.noarch.rpm\n\nx86_64:\npython-qpid-proton-0.32.0-2.el7.x86_64.rpm\nqpid-cpp-client-1.36.0-31.el7amq.x86_64.rpm\nqpid-cpp-client-devel-1.36.0-31.el7amq.x86_64.rpm\nqpid-cpp-debuginfo-1.36.0-31.el7amq.x86_64.rpm\nqpid-proton-c-0.32.0-2.el7.x86_64.rpm\nqpid-proton-c-devel-0.32.0-2.el7.x86_64.rpm\nqpid-proton-cpp-0.32.0-2.el7.x86_64.rpm\nqpid-proton-cpp-devel-0.32.0-2.el7.x86_64.rpm\nqpid-proton-debuginfo-0.32.0-2.el7.x86_64.rpm\nrubygem-qpid_proton-0.32.0-2.el7.x86_64.rpm\n\n8Base-AMQ-Clients-2:\n\nSource:\nnodejs-rhea-1.0.24-1.el8.src.rpm\nqpid-proton-0.32.0-2.el8.src.rpm\n\nnoarch:\nnodejs-rhea-1.0.24-1.el8.noarch.rpm\npython-qpid-proton-docs-0.32.0-2.el8.noarch.rpm\nqpid-proton-c-docs-0.32.0-2.el8.noarch.rpm\nqpid-proton-cpp-docs-0.32.0-2.el8.noarch.rpm\nqpid-proton-tests-0.32.0-2.el8.noarch.rpm\n\nx86_64:\npython3-qpid-proton-0.32.0-2.el8.x86_64.rpm\npython3-qpid-proton-debuginfo-0.32.0-2.el8.x86_64.rpm\nqpid-proton-c-0.32.0-2.el8.x86_64.rpm\nqpid-proton-c-debuginfo-0.32.0-2.el8.x86_64.rpm\nqpid-proton-c-devel-0.32.0-2.el8.x86_64.rpm\nqpid-proton-cpp-0.32.0-2.el8.x86_64.rpm\nqpid-proton-cpp-debuginfo-0.32.0-2.el8.x86_64.rpm\nqpid-proton-cpp-devel-0.32.0-2.el8.x86_64.rpm\nqpid-proton-debuginfo-0.32.0-2.el8.x86_64.rpm\nqpid-proton-debugsource-0.32.0-2.el8.x86_64.rpm\nrubygem-qpid_proton-0.32.0-2.el8.x86_64.rpm\nrubygem-qpid_proton-debuginfo-0.32.0-2.el8.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n8",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-11113"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003617"
      },
      {
        "db": "VULHUB",
        "id": "VHN-163659"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-11113"
      },
      {
        "db": "PACKETSTORM",
        "id": "158650"
      },
      {
        "db": "PACKETSTORM",
        "id": "157741"
      },
      {
        "db": "PACKETSTORM",
        "id": "160601"
      },
      {
        "db": "PACKETSTORM",
        "id": "157859"
      },
      {
        "db": "PACKETSTORM",
        "id": "158651"
      },
      {
        "db": "PACKETSTORM",
        "id": "159208"
      },
      {
        "db": "PACKETSTORM",
        "id": "158636"
      },
      {
        "db": "PACKETSTORM",
        "id": "159271"
      }
    ],
    "trust": 2.52
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2020-11113",
        "trust": 4.2
      },
      {
        "db": "PACKETSTORM",
        "id": "159208",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "158651",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "160601",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "159271",
        "trust": 0.8
      },
      {
        "db": "JVN",
        "id": "JVNVU95897514",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003617",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1735",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "157322",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1399",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1766",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.2588",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.4471",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.3190",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1368",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1882",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.2619",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.3258",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022060909",
        "trust": 0.6
      },
      {
        "db": "NSFOCUS",
        "id": "48047",
        "trust": 0.6
      },
      {
        "db": "PACKETSTORM",
        "id": "158650",
        "trust": 0.2
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-21476",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-163659",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-11113",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "157741",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "157859",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "158636",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-163659"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-11113"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003617"
      },
      {
        "db": "PACKETSTORM",
        "id": "158650"
      },
      {
        "db": "PACKETSTORM",
        "id": "157741"
      },
      {
        "db": "PACKETSTORM",
        "id": "160601"
      },
      {
        "db": "PACKETSTORM",
        "id": "157859"
      },
      {
        "db": "PACKETSTORM",
        "id": "158651"
      },
      {
        "db": "PACKETSTORM",
        "id": "159208"
      },
      {
        "db": "PACKETSTORM",
        "id": "158636"
      },
      {
        "db": "PACKETSTORM",
        "id": "159271"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1735"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-11113"
      }
    ]
  },
  "id": "VAR-202003-1785",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-163659"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-29T22:37:30.055000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "hitachi-sec-2021-109",
        "trust": 0.8,
        "url": "https://github.com/FasterXML/jackson-databind/issues/2670"
      },
      {
        "title": "FasterXML jackson-databind Fixes for code issue vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=115369"
      },
      {
        "title": "Red Hat: Moderate: AMQ Clients 2.8.0 Release",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20203817 - Security Advisory"
      },
      {
        "title": "Red Hat: Important: rh-maven35-jackson-databind security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20201523 - Security Advisory"
      },
      {
        "title": "Red Hat: Moderate: Red Hat Single Sign-On 7.4.0 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20205625 - Security Advisory"
      },
      {
        "title": "Red Hat: Important: Red Hat Data Grid 7.3.7 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20203779 - Security Advisory"
      },
      {
        "title": "Red Hat: Important: Red Hat Decision Manager 7.8.0 Security Update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20203196 - Security Advisory"
      },
      {
        "title": "Red Hat: Important: EAP Continuous Delivery Technical Preview Release 19 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20202333 - Security Advisory"
      },
      {
        "title": "Red Hat: Important: Red Hat Process Automation Manager 7.8.0 Security Update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20203197 - Security Advisory"
      },
      {
        "title": "Red Hat: Important: Red Hat build of Thorntail 2.5.1 security and bug fix update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20202067 - Security Advisory"
      },
      {
        "title": "Red Hat: Important: Red Hat Fuse 7.7.0 release and security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20203192 - Security Advisory"
      },
      {
        "title": "Hitachi Security Advisories: Multiple Vulnerabilities in Cosminexus",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=hitachi_security_advisories\u0026qid=hitachi-sec-2021-109"
      },
      {
        "title": "CVE-2020-11113",
        "trust": 0.1,
        "url": "https://github.com/Al1ex/CVE-2020-11113 "
      },
      {
        "title": "Cubed",
        "trust": 0.1,
        "url": "https://github.com/yahoo/cubed "
      },
      {
        "title": "Java-Deserialization-CVEs",
        "trust": 0.1,
        "url": "https://github.com/PalindromeLabs/Java-Deserialization-CVEs "
      },
      {
        "title": "PoC in GitHub",
        "trust": 0.1,
        "url": "https://github.com/soosmile/POC "
      },
      {
        "title": "PoC in GitHub",
        "trust": 0.1,
        "url": "https://github.com/developer3000S/PoC-in-GitHub "
      },
      {
        "title": "PoC in GitHub",
        "trust": 0.1,
        "url": "https://github.com/hectorgie/PoC-in-GitHub "
      },
      {
        "title": "PoC in GitHub",
        "trust": 0.1,
        "url": "https://github.com/0xT11/CVE-POC "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2020-11113"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003617"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1735"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-502",
        "trust": 1.1
      },
      {
        "problemtype": "Deserialization of untrusted data (CWE-502) [NVD evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-163659"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003617"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-11113"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.6,
        "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html"
      },
      {
        "trust": 1.9,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11113"
      },
      {
        "trust": 1.8,
        "url": "https://security.netapp.com/advisory/ntap-20200403-0002/"
      },
      {
        "trust": 1.8,
        "url": "https://github.com/fasterxml/jackson-databind/issues/2670"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
      },
      {
        "trust": 1.1,
        "url": "https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
      },
      {
        "trust": 0.8,
        "url": "https://jvn.jp/vu/jvnvu95897514/index.html"
      },
      {
        "trust": 0.8,
        "url": "https://access.redhat.com/security/cve/cve-2020-11113"
      },
      {
        "trust": 0.8,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.8,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.8,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.7,
        "url": "https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
      },
      {
        "trust": 0.7,
        "url": "https://access.redhat.com/security/cve/cve-2020-11112"
      },
      {
        "trust": 0.7,
        "url": "https://access.redhat.com/security/cve/cve-2020-10968"
      },
      {
        "trust": 0.7,
        "url": "https://access.redhat.com/security/cve/cve-2020-11111"
      },
      {
        "trust": 0.6,
        "url": "https://access.redhat.com/security/cve/cve-2020-9547"
      },
      {
        "trust": 0.6,
        "url": "https://access.redhat.com/security/cve/cve-2020-10672"
      },
      {
        "trust": 0.6,
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "trust": 0.6,
        "url": "https://access.redhat.com/security/cve/cve-2020-11619"
      },
      {
        "trust": 0.6,
        "url": "https://access.redhat.com/security/cve/cve-2020-10969"
      },
      {
        "trust": 0.6,
        "url": "https://access.redhat.com/security/cve/cve-2020-11620"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1368/"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022060909"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-series-of-vulnerabilities-in-fasterxml-jackson-databind-affect-apache-solr-shipped-with-ibm-operations-analytics-log-analysis/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/159271/red-hat-security-advisory-2020-3817-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-jackson-databind-shipped-with-ibm-cloud-pak-system/"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cognos-business-intelligence-has-addressed-multiple-vulnerabilities-q12021/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.2588/"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cognos-analytics-has-addressed-multiple-vulnerabilities-3/"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/support/pages/node/6525182"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-faster-xml-jackson-databind-affect-ibm-spectrum-protect-plus-cve-2020-10673-cve-2020-1112-cve-2020-11113-cve-2020-10672-cve-2020-10968-cve-2020-10969-cve-2/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.2619/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.3258/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1766/"
      },
      {
        "trust": 0.6,
        "url": "http://www.nsfocus.net/vulndb/48047"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/157322/red-hat-security-advisory-2020-1523-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/160601/red-hat-security-advisory-2020-5625-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1882/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.4471/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/158651/red-hat-security-advisory-2020-3197-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/fasterxml-jackson-databind-denial-of-service-via-openjpa-wasregistrymanagedruntime-serialization-gadgets-typing-32065"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/159208/red-hat-security-advisory-2020-3779-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/support/pages/node/6528214"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnerabilities-in-jackson-databind-affect-ibm-sterling-b2b-integrator-3/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.3190/"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-affects-ibm-jazz-foundation-and-ibm-engineering-products/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1399/"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/cve/cve-2020-9546"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-20330"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/cve/cve-2020-10673"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/cve/cve-2020-9548"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/cve/cve-2020-8840"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-10672"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11111"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/cve/cve-2019-20330"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/cve/cve-2020-7238"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-10968"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2019-17573"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-20444"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11620"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17573"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2019-20445"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2019-20444"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11619"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11112"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-20445"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-10969"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2019-10086"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-10086"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-12406"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-9514"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2020-14060"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2019-9512"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2019-12406"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11612"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2019-9514"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2019-9515"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2020-14061"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2020-14062"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2019-16869"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-9512"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2019-12423"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2020-11612"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-16869"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-12423"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-10673"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2019-16335"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2019-16943"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2019-17531"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-16335"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17531"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2019-14540"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17267"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-16942"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-14892"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-16943"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2019-17267"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2019-14893"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2019-16942"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-14893"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2019-14888"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2019-14892"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-14540"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-14888"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2020-1745"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/errata/rhsa-2020:3817"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14060"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-1718"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-9515"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2019-13990"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2020-1718"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2019-9518"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-13990"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-9518"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14061"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14062"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-9511"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-12400"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-0210"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-0205"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-12419"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2019-0210"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2019-9511"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-14887"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2019-12419"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2019-0205"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2019-12400"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2019-14887"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "trust": 0.2,
        "url": "https://issues.jboss.org/):"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2020-1695"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2019-10172"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2020-9488"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-9488"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-10172"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2020-1757"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/502.html"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/al1ex/cve-2020-11113"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hitachi-sec-2021-109/index.html"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:3196"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions\u0026product=rhdm\u0026version=7.8.0"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-7238"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_decision_manager/7.8/html/release_notes_for_red_hat_decision_manager_7.8/index"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-3875"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-14832"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-10201"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_build_of_thorntail/2.5/html/release_notes_for_thorntail_2.5/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:2067"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-3875"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-14838"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-10219"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-14832"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-10199"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions\u0026product=catrhoar.thorntail\u0026version=2.5.1"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-10201"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-1729"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-10199"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-14838"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-10219"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-14820"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-14820"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-1727"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-1727"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:5625"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=core.service.rhsso\u0026downloadtype=distributions\u0026version=7.4"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhba-2020:1414"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-10174"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:2333"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/jboss_enterprise_application_platform_continuous_delivery/19/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-10688"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-10688"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product\\xeap-cd\u0026downloadtype=securitypatches\u0026version\u0019"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-10174"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-1732"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_process_automation_manager/7.8/html/release_notes_for_red_hat_process_automation_manager_7.8/index"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions\u0026product=rhpam\u0026version=7.8.0"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:3197"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-1719"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-1710"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product\\xdata.grid\u0026downloadtype=securitypatches\u0026version=7.3"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-9547"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-1745"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:3779"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-1719"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-10714"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-1757"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-1695"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-10714"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-9548"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_data_grid/7.3/html/red_hat_data_grid_7.3_release_notes/index"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-8840"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-9546"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-7658"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-1710"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-1748"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-7658"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-1748"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-11797"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-12086"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1000632"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1000632"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-3831"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-0231"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-11797"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions\u0026product=jboss.fuse\u0026version=7.7.0"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-12541"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-3797"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-4970"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-9827"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_fuse/7.7/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-12086"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-4970"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-1953"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-0231"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-9827"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-3831"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-12541"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:3192"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14195"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-3797"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14307"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_amq"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14307"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/key/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14297"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14297"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-163659"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-11113"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003617"
      },
      {
        "db": "PACKETSTORM",
        "id": "158650"
      },
      {
        "db": "PACKETSTORM",
        "id": "157741"
      },
      {
        "db": "PACKETSTORM",
        "id": "160601"
      },
      {
        "db": "PACKETSTORM",
        "id": "157859"
      },
      {
        "db": "PACKETSTORM",
        "id": "158651"
      },
      {
        "db": "PACKETSTORM",
        "id": "159208"
      },
      {
        "db": "PACKETSTORM",
        "id": "158636"
      },
      {
        "db": "PACKETSTORM",
        "id": "159271"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1735"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-11113"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-163659"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-11113"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003617"
      },
      {
        "db": "PACKETSTORM",
        "id": "158650"
      },
      {
        "db": "PACKETSTORM",
        "id": "157741"
      },
      {
        "db": "PACKETSTORM",
        "id": "160601"
      },
      {
        "db": "PACKETSTORM",
        "id": "157859"
      },
      {
        "db": "PACKETSTORM",
        "id": "158651"
      },
      {
        "db": "PACKETSTORM",
        "id": "159208"
      },
      {
        "db": "PACKETSTORM",
        "id": "158636"
      },
      {
        "db": "PACKETSTORM",
        "id": "159271"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1735"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-11113"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-03-31T00:00:00",
        "db": "VULHUB",
        "id": "VHN-163659"
      },
      {
        "date": "2020-03-31T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-11113"
      },
      {
        "date": "2020-04-21T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-003617"
      },
      {
        "date": "2020-07-29T17:52:58",
        "db": "PACKETSTORM",
        "id": "158650"
      },
      {
        "date": "2020-05-18T16:42:53",
        "db": "PACKETSTORM",
        "id": "157741"
      },
      {
        "date": "2020-12-17T18:09:37",
        "db": "PACKETSTORM",
        "id": "160601"
      },
      {
        "date": "2020-05-28T16:22:46",
        "db": "PACKETSTORM",
        "id": "157859"
      },
      {
        "date": "2020-07-29T17:53:05",
        "db": "PACKETSTORM",
        "id": "158651"
      },
      {
        "date": "2020-09-17T14:07:40",
        "db": "PACKETSTORM",
        "id": "159208"
      },
      {
        "date": "2020-07-29T00:05:59",
        "db": "PACKETSTORM",
        "id": "158636"
      },
      {
        "date": "2020-09-23T14:57:38",
        "db": "PACKETSTORM",
        "id": "159271"
      },
      {
        "date": "2020-03-31T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202003-1735"
      },
      {
        "date": "2020-03-31T05:15:13.117000",
        "db": "NVD",
        "id": "CVE-2020-11113"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-12-10T00:00:00",
        "db": "VULHUB",
        "id": "VHN-163659"
      },
      {
        "date": "2023-11-07T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-11113"
      },
      {
        "date": "2024-07-22T06:03:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-003617"
      },
      {
        "date": "2022-06-10T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202003-1735"
      },
      {
        "date": "2024-11-21T04:56:49.317000",
        "db": "NVD",
        "id": "CVE-2020-11113"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1735"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "FasterXML\u00a0jackson-databind\u00a0 Untrusted data deserialization vulnerability in",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003617"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "code problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1735"
      }
    ],
    "trust": 0.6
  }
}

cve-2020-11113

Vulnerability from cvelistv5

Published

2020-03-31 04:37

Modified

2024-08-04 11:21

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).

References

▼	URL	Tags
	https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html	mailing-list, x_refsource_MLIST
	https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20200403-0002/	x_refsource_CONFIRM
	https://github.com/FasterXML/jackson-databind/issues/2670	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujan2021.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

n/a

Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jackson-databind",
            "vendor": "fasterxml",
            "versions": [
              {
                "lessThan": "2.9.10.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "debian_linux",
            "vendor": "debian",
            "versions": [
              {
                "status": "affected",
                "version": "8.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "steelstore_cloud_integrated_storage",
            "vendor": "netapp",
            "versions": [
              {
                "status": "affected",
                "version": "*"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "agile_plm",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "9.3.6"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "autovue_for_agile_product_lifecycle_management",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "21.0.2"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "banking_digital_experience",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "18.3",
                "status": "affected",
                "version": "18.1",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "19.2",
                "status": "affected",
                "version": "19.1",
                "versionType": "custom"
              },
              {
                "status": "affected",
                "version": "20.1"
              },
              {
                "lessThanOrEqual": "2.9.0",
                "status": "affected",
                "version": "2.4.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:communications_calendar_server:8.0.0.4.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "communications_calendar_server",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "8.0.0.5.0",
                "status": "affected",
                "version": "8.0.0.4.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:communications_diameter_signaling_router:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "communications_diameter_signaling_router",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "8.2.2",
                "status": "affected",
                "version": "8.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "communications_element_manager",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "8.2.2",
                "status": "affected",
                "version": "8.2.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "communications_evolved_communications_application_server",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "7.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.4.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "communications_instant_messaging_server",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "10.0.1.4.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "communications_network_charging_and_control",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "6.0.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:communications_network_charging_and_control:12.0.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "communications_network_charging_and_control",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "12.0.3",
                "status": "affected",
                "version": "12.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:communications_session_route_manager:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "communications_session_route_manager",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "8.2.2",
                "status": "affected",
                "version": "8.2.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "enterprise_manager_base_platform",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "13.4.0.0",
                "status": "affected",
                "version": "13.3.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.6:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "financial_services_analytical_applications_infrastructure",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "8.1.0",
                "status": "affected",
                "version": "8.0.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.6:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "financial_services_institutional_performance_analytics",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "8.0.6"
              },
              {
                "status": "affected",
                "version": "8.0.7"
              },
              {
                "status": "affected",
                "version": "8.1.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.6:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "financial_services_price_creation_and_discovery",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "8.0.7",
                "status": "affected",
                "version": "8.0.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:financial_services_retail_customer_analytics:8.0.6:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "financial_services_retail_customer_analytics",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "8.0.6"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "global_lifecycle_management_opatch",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "12.2.0.1.20",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:insurance_policy_administration_j2ee:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "insurance_policy_administration_j2ee",
            "vendor": "oracle",
            "versions": [
              {
                "lessThan": "11.1.0.15",
                "status": "affected",
                "version": "11.0.2.25",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jd_edwards_enterpriseone_orchestrator",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "9.2.4.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "primavera_unifier",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "16.1"
              },
              {
                "status": "affected",
                "version": "16.2"
              },
              {
                "lessThanOrEqual": "17.12",
                "status": "affected",
                "version": "17.7",
                "versionType": "custom"
              },
              {
                "status": "affected",
                "version": "18.8"
              },
              {
                "status": "affected",
                "version": "19.12"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:retail_merchandising_system:15.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "retail_merchandising_system",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "15.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:retail_sales_audit:14.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "retail_sales_audit",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "14.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:retail_service_backbone:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "retail_service_backbone",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "14.1"
              },
              {
                "status": "affected",
                "version": "15.0"
              },
              {
                "status": "affected",
                "version": "16.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "retail_xstore_point_of_service",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "19.0",
                "status": "affected",
                "version": "15.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:weblogic_server:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "weblogic_server",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "12.2.1.4.0",
                "status": "affected",
                "version": "12.2.1.3.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2020-11113",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-25T04:00:43.551763Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-502",
                "description": "CWE-502 Deserialization of Untrusted Data",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:12:17.648Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:21:14.618Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[debian-lts-announce] 20200417 [SECURITY] [DLA 2179-1] jackson-databind security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200403-0002/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/FasterXML/jackson-databind/issues/2670"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-20T10:38:50",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[debian-lts-announce] 20200417 [SECURITY] [DLA 2179-1] jackson-databind security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200403-0002/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/issues/2670"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-11113",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[debian-lts-announce] 20200417 [SECURITY] [DLA 2179-1] jackson-databind security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html"
            },
            {
              "name": "https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062",
              "refsource": "MISC",
              "url": "https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200403-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200403-0002/"
            },
            {
              "name": "https://github.com/FasterXML/jackson-databind/issues/2670",
              "refsource": "MISC",
              "url": "https://github.com/FasterXML/jackson-databind/issues/2670"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-11113",
    "datePublished": "2020-03-31T04:37:27",
    "dateReserved": "2020-03-31T00:00:00",
    "dateUpdated": "2024-08-04T11:21:14.618Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

var-202003-1785

Vulnerability from variot

cve-2020-11113

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature