CVE-2019-20330 - CVE House
Back to Database
Status published Critical CVE-2019-20330

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking....

Vulnerability Description

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-20330

Credits & Attribution

No credits recorded in the NVD database.

References

More from fasterxml

View All →
CVE-2022-42004
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because...
High 7.5
CVE-2022-42003
In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion...
High 7.5
CVE-2021-46877
jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1...
Unknown 0
CVE-2020-9548
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization...
Critical 9.8
CVE-2020-9547
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization...
Critical 9.8

Affected Vendor

Affected Software

jackson-databind, banking platform, communications billing and revenue management, communications cloud native core network slice selection function, communications contacts server, communications evolved communications application server, communications instant messaging server, communications network charging and control, customer management and segmentation foundation, enterprise manager base platform, global lifecycle management opatch, goldengate application adapters, goldengate stream analytics, jd edwards enterpriseone orchestrator, jd edwards enterpriseone tools, primavera unifier, retail merchandising system, retail sales audit, retail xstore point of service, siebel engineering - installer \& deployment, siebel ui framework, trace file analyzer, webcenter portal, weblogic server, debian linux, active iq unified manager, oncommand api services, service level manager, snapcenter, steelstore cloud integrated storage
Vulnerable Versions:
2.0.0, 2.8.0, 2.9.0, 2.4.0, 7.5.0.23.0, 12.0.0.3.0, 1.2.1, 8.0.0.4.0, 7.1, 10.0.1.4.0, 12.0.0, 6.0.1, 18.0, 13.3.0.0, 13.4.0.0, 0, 12.2.0.1.0, 13.9.4.0.0, 19.1.0.0.0, 17.7, 16.1, 16.2, 18.8, 19.12, 15.0.3, 16.0.2, 16.0.3, 14.1, 15.0, 16.0, 17.0, 19.0, 12.2.0.1, 18c, 19c, 12.2.1.3.0, 12.2.1.4.0, 8.0, 7.3, 9.5

Timeline

Official Publish: January 3rd, 2020
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.