An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
{
"unresolved_ranges": [
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "12.1.0.2.0"
}
],
"cpe": "cpe:2.3:a:oracle:clusterware:12.1.0.2.0:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "10.0.1.2.0"
}
],
"cpe": "cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.2.0:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"fixed": "11.2.0.3.23"
},
{
"introduced": "12.2.0.1.0"
},
{
"fixed": "12.2.0.1.19"
},
{
"introduced": "13.9.4.0.0"
},
{
"fixed": "13.9.4.2.1"
}
],
"cpe": "cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "17.0"
}
],
"cpe": "cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "2.7.0.1"
}
],
"cpe": "cpe:2.3:a:oracle:utilities_advanced_spatial_and_operational_analytics:2.7.0.1:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "3.11"
}
],
"cpe": "cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "4.1"
}
],
"cpe": "cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*"
}
]
}{
"source": "CPE_FIELD",
"extracted_events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.6.7.3"
},
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.9.4"
},
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.11.2"
},
{
"introduced": "2.9.0"
},
{
"fixed": "2.9.6"
}
],
"cpe": "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*"
}