CVE-2020-9546 in Retail Sales Audit

Summary

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Reservation

03/02/2020

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
168407	Oracle Retail Sales Audit Rule Wizards deserialization	502	Not defined	Official fix	CVE-2020-9546
168406	Oracle Retail Merchandising System Foundation deserialization	502	Not defined	Official fix	CVE-2020-9546
163329	Oracle Retail Service Backbone RSB kernel deserialization	502	Not defined	Official fix	CVE-2020-9546
163239	Oracle Insurance Policy Administration J2EE Architecture deserialization	502	Not defined	Official fix	CVE-2020-9546
163124	Oracle Financial Services Retail Customer Analytics User deserialization	502	Not defined	Official fix	CVE-2020-9546
163122	Oracle Financial Services Price Creation and Discovery User deserialization	502	Not defined	Official fix	CVE-2020-9546
163121	Oracle Financial Services Institutional Performance Analytics User deserialization	502	Not defined	Official fix	CVE-2020-9546
163120	Oracle Financial Services Analytical Applications Infrastructure deserialization	502	Not defined	Official fix	CVE-2020-9546
158420	Oracle Retail Xstore Point of Service Xenvironment deserialization	502	Not defined	Official fix	CVE-2020-9546
158355	Oracle JD Edwards EnterpriseOne Tools Web Runtime deserialization	502	Not defined	Official fix	CVE-2020-9546
158354	Oracle JD Edwards EnterpriseOne Tools Monitoring/Diagnostics deserialization	502	Not defined	Official fix	CVE-2020-9546
158353	Oracle JD Edwards EnterpriseOne Tools EnterpriseOne Mobility Sec deserialization	502	Not defined	Official fix	CVE-2020-9546
158352	Oracle JD Edwards EnterpriseOne Orchestrator E1 IOT Orchestrator Security deserialization	502	Not defined	Official fix	CVE-2020-9546
158272	Oracle WebLogic Server Centralized Thirdparty Jars deserialization	502	Not defined	Official fix	CVE-2020-9546
158229	Oracle Banking Platform Framework deserialization	502	Not defined	Official fix	CVE-2020-9546
158214	Oracle Enterprise Manager Base Platform Enterprise Manager Install deserialization	502	Not defined	Official fix	CVE-2020-9546
158166	Oracle Primavera Unifier Platform deserialization	502	Not defined	Official fix	CVE-2020-9546
158122	Oracle Communications Network Charging/Control Installer deserialization	502	Not defined	Official fix	CVE-2020-9546
158113	Oracle Communications Instant Messaging Server Presence API deserialization	502	Not defined	Official fix	CVE-2020-9546
158111	Oracle Communications Evolved Communications Application Server Session Design Center/Universal Data Recorder deserialization	502	Not defined	Official fix	CVE-2020-9546
158109	Oracle Communications Contacts Server Core deserialization	502	Not defined	Official fix	CVE-2020-9546
158095	Oracle Global Lifecycle Management/OPatch Patch Installer deserialization	502	Not defined	Official fix	CVE-2020-9546
150782	FasterXML jackson-databind Serialized deserialization	502	Not defined	Official fix	CVE-2020-9546

Sources

• MITRE
• NVD
• CVE Details