RHSA-2020:1523HighCVSS 8.8

Red Hat Security Advisory: rh-maven35-jackson-databind security update

Published
April 21, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (5)

CVE-2020-10969 →CVE-2020-11111 →CVE-2020-11112 →CVE-2020-11113 →CVE-2020-10968 →

📋 Description

CVE-2020-10968 — jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider CVE-2020-10969 — jackson-databind: Serialization gadgets in javax.swing.JEditorPane CVE-2020-11111 — jackson-databind: Serialization gadgets in org.apache.activemq.jms.pool.XaPooledConnectionFactory CVE-2020-11112 — jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider CVE-2020-11113 — jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime

🎯 Affected products20

  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-maven35-jackson-databind-0:2.7.6-2.9.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-maven35-jackson-databind-0:2.7.6-2.9.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)
  • rh-maven35-jackson-databind-0:2.7.6-2.9.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-maven35-jackson-databind-0:2.7.6-2.9.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-maven35-jackson-databind-0:2.7.6-2.9.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-maven35-jackson-databind-0:2.7.6-2.9.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-maven35-jackson-databind-0:2.7.6-2.9.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)
  • rh-maven35-jackson-databind-0:2.7.6-2.9.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-maven35-jackson-databind-0:2.7.6-2.9.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-maven35-jackson-databind-0:2.7.6-2.9.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-maven35-jackson-databind-javadoc-0:2.7.6-2.9.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-maven35-jackson-databind-javadoc-0:2.7.6-2.9.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)
  • rh-maven35-jackson-databind-javadoc-0:2.7.6-2.9.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-maven35-jackson-databind-javadoc-0:2.7.6-2.9.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-maven35-jackson-databind-javadoc-0:2.7.6-2.9.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`

🔗 References (8)