CVE-2020-10650: High severity fasterxml jackson-databind vulnerability
A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.
Other sources
The com.fasterxml.jackson.core:jackson-databind library before version 2.9.10.4 is vulnerable to an Unsafe Deserialization vulnerability when handling interactions related to the class ignite-jta.
— GitHub
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-10650?
CVE-2020-10650 is a vulnerability found in the com.fasterxml.jackson.core:jackson-databind library before version 2.9.10.4.
What is the severity of CVE-2020-10650?
The severity of CVE-2020-10650 is high with a CVSS score of 8.1.
How does CVE-2020-10650 work?
CVE-2020-10650 is a deserialization flaw that allows an unauthenticated user to perform code execution via certain classes.
What is the affected software?
The affected software includes com.fasterxml.jackson.core:jackson-databind version up to 2.9.10.3, FasterXML jackson-databind up to 2.9.10.4, Oracle Retail Merchandising System version 15.0, and Oracle Retail Sales Audit version 14.1.
How can I fix CVE-2020-10650?
To fix CVE-2020-10650, you should upgrade the affected library or software to version 2.9.10.4 or later.