Deserialization in Fasterxml Jackson-Databind
CVE-2019-20330
FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
Vulnerability class: Insecure Deserialization
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.086 (95.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 95th percentile — 95.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.086 · newest: 0.086 · change: 0.000
Affected products
- Fasterxml Jackson-Databind
- NetApp Active Iq Unified Manager
- NetApp Oncommand API Services
- NetApp Service Level Manager
- NetApp Snapcenter
- NetApp Steelstore Cloud Integrated Storage
- Oracle Banking Platform
- Oracle Communications Billing And Revenue Management — versions 7.5.0.23.0, 12.0.0.3.0
- Oracle Communications Cloud Native Core Network Slice Selection Function — versions 1.2.1
- Oracle Communications Contacts Server — versions 8.0.0.4.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.apache.org/thread.html/rd6c6fef14944f3dcfb58d35f9317eb1c32a700e86c1b5231e… (mailing-list)
- lists.apache.org/thread.html/rb532fed78d031fff477fd840b81946f6d1200f93a63698dae… (mailing-list)
- lists.apache.org/thread.html/r5c3644c97f0434d1ceb48ff48897a67bdbf3baf7efbe7d046… (mailing-list)
- lists.apache.org/thread.html/r7fb123e7dad49af5886cfec7135c0fd5b74e4c67af029e1dc… (mailing-list)
- lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed… (mailing-list)
- lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b8052… (mailing-list)
- lists.apache.org/thread.html/r5c14fdcabdeaba258857bcb67198652e4dce1d33ddc590cd8… (mailing-list)
- lists.apache.org/thread.html/r909c822409a276ba04dc2ae31179b16f6864ba02c4f9911bd… (mailing-list)
- lists.apache.org/thread.html/r5d3d10fdf28110da3f9ac1b7d08d7e252f98d7d37ce0a6bd1… (mailing-list)
- lists.apache.org/thread.html/r50f513772f12e1babf65c7c2b9c16425bac2d945351879e2e… (mailing-list)
Frequently asked questions
- What is CVE-2019-20330?
- CVE-2019-20330 is a critical-severity vulnerability in Fasterxml Jackson-Databind, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2020-01-03.
- How severe is CVE-2019-20330?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2019-20330 known to be exploited?
- 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.