Strix
26.1K

CVE-2019-20330

CRITICALCVSS 9.8/10EPSS 8.64%

Last modified

CVE-2019-20330 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.. EPSS estimates a 8.64% chance of exploitation in the next 30 days.

Description

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.

Metrics

CVSS 3.1
9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
8.64%

94.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
FasterxmlJackson-Databind>= 2.0.0, < 2.7.9.7
FasterxmlJackson-Databind>= 2.8.0, < 2.8.11.5
FasterxmlJackson-Databind>= 2.9.0, < 2.9.10.2
OracleBanking Platform>= 2.4.0, <= 2.9.0
OracleCommunications Billing And Revenue Management7.5.0.23.0
OracleCommunications Billing And Revenue Management12.0.0.3.0
OracleCommunications Cloud Native Core Network Slice Selection Function1.2.1
OracleCommunications Contacts Server8.0.0.4.0
OracleCommunications Evolved Communications Application Server7.1
OracleCommunications Instant Messaging Server10.0.1.4.0
OracleCommunications Network Charging And Control>= 12.0.0, <= 12.0.3
OracleCommunications Network Charging And Control6.0.1
OracleCustomer Management And Segmentation Foundation18.0
OracleEnterprise Manager Base Platform13.3.0.0
OracleEnterprise Manager Base Platform13.4.0.0
OracleGlobal Lifecycle Management Opatch< 11.2.0.3.23
OracleGlobal Lifecycle Management Opatch>= 12.2.0.1.0, < 12.2.0.1.19
OracleGlobal Lifecycle Management Opatch>= 13.9.4.0.0, < 13.9.4.2.1
OracleGoldengate Application Adapters19.1.0.0.0
OracleGoldengate Stream Analytics< 19.1.0.0.1
OracleJd Edwards Enterpriseone Orchestrator< 9.2.4.2
OracleJd Edwards Enterpriseone Tools< 9.2.4.2
OraclePrimavera Unifier>= 17.7, <= 17.12
OraclePrimavera Unifier16.1
OraclePrimavera Unifier16.2
OraclePrimavera Unifier18.8
OraclePrimavera Unifier19.12
OracleRetail Merchandising System15.0.3
OracleRetail Merchandising System16.0.2
OracleRetail Merchandising System16.0.3
OracleRetail Sales Audit14.1
OracleRetail Xstore Point Of Service15.0
OracleRetail Xstore Point Of Service16.0
OracleRetail Xstore Point Of Service17.0
OracleRetail Xstore Point Of Service18.0
OracleRetail Xstore Point Of Service19.0
OracleSiebel Engineering - Installer \& Deployment<= 2.20.5
OracleSiebel Ui Framework<= 20.5
OracleTrace File Analyzer12.2.0.1
OracleTrace File Analyzer18c
OracleTrace File Analyzer19c
OracleWebcenter Portal12.2.1.3.0
OracleWebcenter Portal12.2.1.4.0
OracleWeblogic Server12.2.1.3.0
OracleWeblogic Server12.2.1.4.0
DebianDebian Linux8.0
NetappActive Iq Unified Manager>= 7.3
NetappActive Iq Unified Manager>= 9.5
NetappOncommand Api ServicesAll versions
NetappService Level ManagerAll versions

Showing 50 of 52 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2019-20330?
FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
How severe is CVE-2019-20330?
CVE-2019-20330 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 8.64% probability of exploitation in the next 30 days.
How do I fix CVE-2019-20330?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-20330?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST