RHSA-2020:1523: Important: rh-maven35-jackson-databind security update
The jackson-databind package provides general data-binding functionality for Jackson, which works on top of Jackson core streaming API.Security Fix(es): jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider..RmiProvider (CVE-2020-10968) jackson-databind: Serialization gadgets in javax.swing.JEditorPane (CVE-2020-10969) jackson-databind: Serialization gadgets in org.apache.activemq.jms.pool.XaPooledConnectionFactory (CVE-2020-11111) jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider (CVE-2020-11112) jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime (CVE-2020-11113) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What security issues are addressed in RHSA-2020:1523?
RHSA-2020:1523 addresses vulnerabilities related to serialization gadgets in the jackson-databind package, specifically CVE-2020-10968.
How do I fix RHSA-2020:1523?
To fix RHSA-2020:1523, upgrade to the jackson-databind package version 2.7.6-2.9.el7 or later.
Who is affected by RHSA-2020:1523?
RHSA-2020:1523 affects systems using the rh-maven35-jackson-databind package versions prior to 2.7.6-2.9.el7.
What is the risk of not addressing RHSA-2020:1523?
Failing to address RHSA-2020:1523 can leave systems vulnerable to remote code execution attacks through serialization exploits.
Is there a recommended action for RHSA-2020:1523?
The recommended action for RHSA-2020:1523 is to apply the security updates as soon as possible to mitigate potential risks.