RHSA-2020:4312HighCVSS 7.5

Red Hat Security Advisory: rh-maven35-jackson-databind security update

Published
October 22, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (1)

CVE-2020-25649 →

📋 Description

CVE-2020-25649 — jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)

🎯 Affected products16

  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-maven35-jackson-databind-0:2.7.6-2.12.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-maven35-jackson-databind-0:2.7.6-2.12.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-maven35-jackson-databind-0:2.7.6-2.12.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-maven35-jackson-databind-0:2.7.6-2.12.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-maven35-jackson-databind-0:2.7.6-2.12.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-maven35-jackson-databind-0:2.7.6-2.12.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-maven35-jackson-databind-0:2.7.6-2.12.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-maven35-jackson-databind-0:2.7.6-2.12.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-maven35-jackson-databind-javadoc-0:2.7.6-2.12.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-maven35-jackson-databind-javadoc-0:2.7.6-2.12.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-maven35-jackson-databind-javadoc-0:2.7.6-2.12.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-maven35-jackson-databind-javadoc-0:2.7.6-2.12.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: There is currently no known mitigation for this flaw.

🔗 References (4)