Vulnerability Description
FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fasterxml | Jackson-Databind | >= 2.0.0, < 2.7.9.7 |
| Debian | Debian Linux | 8.0 |
| Netapp | Oncommand Api Services | - |
| Netapp | Oncommand Workflow Automation | - |
| Netapp | Service Level Manager | - |
| Netapp | Steelstore Cloud Integrated Storage | - |
| Huawei | Oceanstor 9000 Firmware | v300r006c20 |
| Huawei | Oceanstor 9000 | - |
| Oracle | Global Lifecycle Management Opatch | < 11.2.0.3.23 |
Related Weaknesses (CWE)
References
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200610-01-fastjasThird Party Advisory
- https://github.com/FasterXML/jackson-databind/issues/2620Third Party Advisory
- https://lists.apache.org/thread.html/r078e68a926ea6be12e8404e47f45aabf04bb4668e8
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab
- https://lists.apache.org/thread.html/r1c09b9551f6953dbeca190a4c4b78198cdbb9825fc
- https://lists.apache.org/thread.html/r1efc776fc6ce3387593deaa94bbdd296733b1b0140
- https://lists.apache.org/thread.html/r2fa8046bd47fb407ca09b5107a80fa6147ba4ebe87
- https://lists.apache.org/thread.html/r319f19c74e06c201b9d4e8b282a4e4b2da6dcda022
- https://lists.apache.org/thread.html/r3539bd3a377991217d724879d239e16e86001c5416
- https://lists.apache.org/thread.html/r3d20a2660b36551fd8257d479941782af4a7169582
- https://lists.apache.org/thread.html/r428d068b2a4923f1a5a4f5fc6381b95205cfe76201
- https://lists.apache.org/thread.html/r446646c5588b10f5e02409ad580b12f314869009cd
- https://lists.apache.org/thread.html/r46bebdeb59b8b7212d63a010ca445a9f5c4e9d64dc
- https://lists.apache.org/thread.html/r5d8bea8e9d17b6efcf4a0e4e194e91ef46a99f5057
- https://lists.apache.org/thread.html/r65ee95fa09c831843bac81eaa582fdddc2b6119912
FAQ
What is CVE-2020-8840?
CVE-2020-8840 is a vulnerability with a CVSS score of 9.8 (CRITICAL). FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
How severe is CVE-2020-8840?
CVE-2020-8840 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2020-8840?
Check the references section above for vendor advisories and patch information. Affected products include: Fasterxml Jackson-Databind, Debian Debian Linux, Netapp Oncommand Api Services, Netapp Oncommand Workflow Automation, Netapp Service Level Manager.