Staging Environment: Content and features may be unstable or change without notice.

Advisory Weakness Curation

CVE-2020-24616

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-h3cw-g4mq-c5x2

Code Injection in jackson-databind This project contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).

gitlab/maven/com.fasterxml.jackson.core/jackson-databind/CVE-2020-24616

Code Injection in jackson-databind This project contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).

gitlab/maven/com.fasterxml.jackson.dataformat/jackson-dataformat-xml/CVE-2020-24616

Deserialization of Untrusted Data FasterXML jackson-databind mishandles the interaction between serialization gadgets and typing, related to `br.com.anteros.dbcp.AnterosDBCPDataSource` (aka Anteros-DBCP).