Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el6 | eap7-jackson-databind | 0:2.10.4-1.redhat_00002.1.el6eap |
| Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el7 | eap7-jackson-databind | 0:2.10.4-1.redhat_00002.1.el7eap |
| Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.3::el8 | eap7-jackson-databind | 0:2.10.4-1.redhat_00002.1.el8eap |
Vulnerabilities 1
-
High 7.5CVE-2020-25649 EPSS 18%
XML External Entity (XXE) Injection in Jackson Databind
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
article
https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/
-
article
https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1887664
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4401.json
-
report
https://access.redhat.com/security/cve/CVE-2020-25649
-
advisory
https://www.cve.org/CVERecord?id=CVE-2020-25649
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-25649
-
article
https://github.com/FasterXML/jackson-databind/issues/2589