Description
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | jackson-databind | jackson-databind-2.11.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jackson-databind | 2.11.1-1 | — |
| Debian 13 | jackson-databind | 2.11.1-1 | — |
| Debian 12 | jackson-databind | 2.11.1-1 | — |
| Debian 9 | jackson-databind | 2.8.6-1+deb9u8 | DLA-2406-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | jackson-databind | No fix yet | — |
| Ubuntu 18.04 LTS | jackson-databind | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | jackson-databind | No fix yet | — |
| Ubuntu Pro 14.04 LTS | jackson-databind | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | rh-maven35-jackson-databind +1 | 2.7.6-2.12.el7 | RHSA-2020:4312 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | ovirt-engine-dwh +2 | 4.4.4.2-1.el8ev | RHSA-2021:0381 |
| Red Hat Rhev Manager 4 | ovirt-web-ui | 1.6.6-1.el8ev | RHSA-2021:0381 |
| Red Hat Rhev Manager 4 | rhv-log-collector-analyzer | 1.0.6-1.el8ev | RHSA-2021:0381 |
| Red Hat Rhev Manager 4 | rhvm +19 | 4.4.4.5-0.10.el8ev | RHSA-2021:0381 |
| Red Hat Rhev Manager 4 | vdsm-jsonrpc-java | 1.6.0-1.el8ev | RHSA-2021:0381 |
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 2.9.0-6.redhat_00016.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-fge-btf | 1.2.0-1.redhat_00007.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-fge-msg-simple | 1.1.0-1.redhat_00007.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.2.11-1.Final_redhat_00001.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-hibernate-validator +1 | 6.0.21-1.Final_redhat_00001.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-jackson-core +8 | 2.10.4-1.redhat_00002.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-jackson-coreutils | 1.6.0-1.redhat_00006.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-jackson-modules-base +1 | 2.10.4-3.redhat_00002.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-jasypt | 1.9.3-1.redhat_00002.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-jboss-marshalling +1 | 2.0.10-1.Final_redhat_00001.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.19-1.Final_redhat_00001.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +21 | 1.7.2-3.Final_redhat_00004.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.7.11-1.Final_redhat_00001.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.32-1.SP1_redhat_00001.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.3.4-3.GA_redhat_00003.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.10.9-1.Final_redhat_00001.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.3.4-3.GA_redhat_00003.1.el7eap | RHSA-2020:5341 |
| Red Hat JBoss EAP 7 | eap7-wildfly-openssl +1 | 1.0.12-1.Final_redhat_00001.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | jackson-core +1 | 2.13.0-150200.3.6.1 | SUSE-SU-2022:1678-1 |
| SLES 15 SP4 | jackson-databind | 2.13.0-150200.3.9.1 | SUSE-SU-2022:1678-1 |
| SLES 15 SP4 | jackson-dataformats-binary | 2.13.0-150200.3.3.3 | SUSE-SU-2022:1678-1 |
| SLES 15 SP3 | jackson-core +1 | 2.13.0-150200.3.6.1 | SUSE-SU-2022:1678-1 |
| SLES 15 SP3 | jackson-databind | 2.13.0-150200.3.9.1 | SUSE-SU-2022:1678-1 |
| SLES 15 SP3 | jackson-dataformats-binary | 2.13.0-150200.3.3.3 | SUSE-SU-2022:1678-1 |
| SLES 15 SP2 | jackson-core +1 | 2.13.0-150200.3.6.1 | SUSE-SU-2022:1678-1 |
| SLES 15 SP2 | jackson-databind | 2.10.5.1-3.3.2 | SUSE-SU-2022:1678-1, SUSE-SU-2021:0243-1 |
| SLES 15 SP2 | jackson-dataformats-binary | 2.13.0-150200.3.3.3 | SUSE-SU-2022:1678-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP2 | jackson-core +1 | 2.13.0-150200.3.6.1 | SUSE-SU-2022:1678-1 |
| SLES for SAP 15 SP2 | jackson-databind | 2.13.0-150200.3.9.1 | SUSE-SU-2022:1678-1 |
| SLES for SAP 15 SP2 | jackson-dataformats-binary | 2.13.0-150200.3.3.3 | SUSE-SU-2022:1678-1 |
| SLE Real Time 15 SP2 | jackson-core +1 | 2.13.0-150200.3.6.1 | SUSE-SU-2022:1678-1 |
| SLE Real Time 15 SP2 | jackson-databind | 2.13.0-150200.3.9.1 | SUSE-SU-2022:1678-1 |
| SLE Real Time 15 SP2 | jackson-dataformats-binary | 2.13.0-150200.3.3.3 | SUSE-SU-2022:1678-1 |
| SLE HPC 15 SP2 | jackson-core +1 | 2.13.0-150200.3.6.1 | SUSE-SU-2022:1678-1 |
| SLE HPC 15 SP2 | jackson-databind | 2.13.0-150200.3.9.1 | SUSE-SU-2022:1678-1 |
| SLE HPC 15 SP2 | jackson-dataformats-binary | 2.13.0-150200.3.3.3 | SUSE-SU-2022:1678-1 |
| SUSE Manager Server 4.1 | jackson-core +1 | 2.13.0-150200.3.6.1 | SUSE-SU-2022:1678-1 |
| SUSE Manager Server 4.1 | jackson-databind | 2.13.0-150200.3.9.1 | SUSE-SU-2022:1678-1 |
| SUSE Manager Server 4.1 | jackson-dataformats-binary | 2.13.0-150200.3.3.3 | SUSE-SU-2022:1678-1 |
| SUSE Manager Retail Branch Server 4.1 | jackson-core +1 | 2.13.0-150200.3.6.1 | SUSE-SU-2022:1678-1 |
| SUSE Manager Retail Branch Server 4.1 | jackson-databind | 2.13.0-150200.3.9.1 | SUSE-SU-2022:1678-1 |
| SUSE Manager Retail Branch Server 4.1 | jackson-dataformats-binary | 2.13.0-150200.3.3.3 | SUSE-SU-2022:1678-1 |
| SUSE Manager Proxy 4.1 | jackson-core +1 | 2.13.0-150200.3.6.1 | SUSE-SU-2022:1678-1 |
| SUSE Manager Proxy 4.1 | jackson-databind | 2.13.0-150200.3.9.1 | SUSE-SU-2022:1678-1 |
| SUSE Manager Proxy 4.1 | jackson-dataformats-binary | 2.13.0-150200.3.3.3 | SUSE-SU-2022:1678-1 |
| SUSE Enterprise Storage 7 | jackson-core +1 | 2.13.0-150200.3.6.1 | SUSE-SU-2022:1678-1 |
| SUSE Enterprise Storage 7 | jackson-databind | 2.13.0-150200.3.9.1 | SUSE-SU-2022:1678-1 |
| SUSE Enterprise Storage 7 | jackson-dataformats-binary | 2.13.0-150200.3.3.3 | SUSE-SU-2022:1678-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | jackson-bom | 2.13.0-150200.3.3.1 | SUSE-SU-2022:1678-1 |
| openSUSE Leap 15.4 | jackson-core +1 | 2.13.0-150200.3.6.1 | SUSE-SU-2022:1678-1 |
| openSUSE Leap 15.4 | jackson-databind | 2.13.0-150200.3.9.1 | SUSE-SU-2022:1678-1 |
| openSUSE Leap 15.4 | jackson-dataformats-binary | 2.13.0-150200.3.3.3 | SUSE-SU-2022:1678-1 |
| openSUSE Leap 15.3 | jackson-bom | 2.13.0-150200.3.3.1 | SUSE-SU-2022:1678-1 |
| openSUSE Leap 15.3 | jackson-core +1 | 2.13.0-150200.3.6.1 | SUSE-SU-2022:1678-1 |
| openSUSE Leap 15.3 | jackson-databind | 2.13.0-150200.3.9.1 | SUSE-SU-2022:1678-1 |
| openSUSE Leap 15.3 | jackson-dataformats-binary | 2.13.0-150200.3.3.3 | SUSE-SU-2022:1678-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.6.0, < 2.6.7.4 | 2.6.7.4 | GHSA-288c-cq4h-88gq |
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.7.0.0, < 2.9.10.7 | 2.9.10.7 | GHSA-288c-cq4h-88gq |
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.10.0.0, < 2.10.5.1 | 2.10.5.1 | GHSA-288c-cq4h-88gq |
Advisories 18
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- RHSA-2021:0381 Red Hat Security Advisory: RHV-M(ovirt-engine) 4.4.z security, bug fix, enhancement update [ovirt-4.4.4] Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2020:5342 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.4 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2020:5340 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.4 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2020:5341 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.4 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2020:4401 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2020:4312 Red Hat Security Advisory: rh-maven35-jackson-databind security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- DLA-2406-1 jackson-databind - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2022:1678-1 Security update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:0243-1 Security update for jackson-databind SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-1375 JFrog Artifactory: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- WID-SEC-2025-1459 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 3, 2025
- NCSC-2025-0128 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Apr 16, 2025
- WID-SEC-2025-0818 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2025
- WID-SEC-2024-2180 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 18, 2024
- WID-SEC-2024-0090 Red Hat Software Collections: Schwachstelle ermöglicht XXE BSI CERT-Bund (WID) · Jan 15, 2024
- WID-SEC-2023-1012 Oracle Insurance Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
- WID-SEC-2022-0616 IBM Tivoli Network Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 23, 2023
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1887664
- https://github.com/FasterXML/jackson-databind/issues/2589
- [kafka-jira] 20201205 [GitHub] [kafka] sirocchj opened a new pull request #9702: CVE-2020-25649: bumping jackson to patched version 2.10.5.1 mailing-list
- [druid-commits] 20201208 [GitHub] [druid] jihoonson opened a new pull request #10655: Bump up jackson-databind to 2.10.5.1 mailing-list
- [kafka-jira] 20201209 [GitHub] [kafka] ijuma commented on pull request #9702: CVE-2020-25649: bumping jackson to patched version 2.10.5.1 mailing-list
- [kafka-jira] 20201209 [GitHub] [kafka] niteshmor commented on pull request #9702: CVE-2020-25649: bumping jackson to patched version 2.10.5.1 mailing-list
- [kafka-jira] 20201209 [GitHub] [kafka] sirocchj edited a comment on pull request #9702: CVE-2020-25649: bumping jackson to patched version 2.10.5.1 mailing-list
- [kafka-jira] 20201209 [GitHub] [kafka] sirocchj commented on pull request #9702: CVE-2020-25649: bumping jackson to patched version 2.10.5.1 mailing-list
- [kafka-jira] 20201210 [GitHub] [kafka] sirocchj commented on pull request #9702: CVE-2020-25649: bumping jackson to patched version 2.10.5.1 mailing-list
- [kafka-jira] 20201210 [GitHub] [kafka] niteshmor edited a comment on pull request #9702: CVE-2020-25649: bumping jackson to patched version 2.10.5.1 mailing-list
- [kafka-jira] 20201210 [GitHub] [kafka] niteshmor commented on pull request #9702: CVE-2020-25649: bumping jackson to patched version 2.10.5.1 mailing-list
- [kafka-jira] 20201215 [GitHub] [kafka] ijuma commented on pull request #9702: CVE-2020-25649: bumping jackson to patched version 2.10.5.1 mailing-list
- [kafka-users] 20201215 Re: [VOTE] 2.7.0 RC5 mailing-list
- [kafka-dev] 20201215 Re: [VOTE] 2.7.0 RC5 mailing-list
- [kafka-jira] 20201215 [GitHub] [kafka] ijuma merged pull request #9702: CVE-2020-25649: bumping jackson to patched version 2.10.5.1 mailing-list
- [kafka-jira] 20201215 [GitHub] [kafka] ijuma edited a comment on pull request #9702: CVE-2020-25649: bumping jackson to patched version 2.10.5.1 mailing-list
- [zookeeper-issues] 20210105 [jira] [Created] (ZOOKEEPER-4045) CVE-2020-25649 - Upgrade jackson databind to 2.10.5.1 mailing-list
- [zookeeper-issues] 20210105 [jira] [Updated] (ZOOKEEPER-4045) CVE-2020-25649 - Upgrade jackson databind to 2.10.5.1 mailing-list
- [zookeeper-dev] 20210105 [jira] [Created] (ZOOKEEPER-4045) CVE-2020-25649 - Upgrade jackson databind to 2.10.5.1 mailing-list
- [kafka-dev] 20210105 Re: [kafka-clients] Re: [VOTE] 2.6.1 RC3 mailing-list
- [kafka-users] 20210105 Re: [kafka-clients] Re: [VOTE] 2.6.1 RC3 mailing-list
- [zookeeper-issues] 20210106 [jira] [Updated] (ZOOKEEPER-4045) CVE-2020-25649 - Upgrade jackson databind to 2.10.5.1 mailing-list
- [zookeeper-notifications] 20210106 [GitHub] [zookeeper] edwin092 opened a new pull request #1572: ZOOKEEPER-4045: CVE-2020-25649 - Upgrade jackson databind to 2.10.5.1 mailing-list
- [zookeeper-issues] 20210106 [jira] [Commented] (ZOOKEEPER-4045) CVE-2020-25649 - Upgrade jackson databind to 2.10.5.1 mailing-list
- [zookeeper-notifications] 20210106 [GitHub] [zookeeper] asfgit closed pull request #1572: ZOOKEEPER-4045: CVE-2020-25649 - Upgrade jackson databind to 2.10.5.1 mailing-list
- [zookeeper-commits] 20210106 [zookeeper] branch branch-3.5.9 updated: ZOOKEEPER-4045: CVE-2020-25649 - Upgrade jackson databind to 2.10.5.1 mailing-list
- [zookeeper-commits] 20210106 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-4045: CVE-2020-25649 - Upgrade jackson databind to 2.10.5.1 mailing-list
- [zookeeper-commits] 20210106 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-4045: CVE-2020-25649 - Upgrade jackson databind to 2.10.5.1 mailing-list
- [zookeeper-notifications] 20210106 [GitHub] [zookeeper] nkalmar commented on pull request #1572: ZOOKEEPER-4045: CVE-2020-25649 - Upgrade jackson databind to 2.10.5.1 mailing-list
- [zookeeper-commits] 20210106 [zookeeper] branch master updated: ZOOKEEPER-4045: CVE-2020-25649 - Upgrade jackson databind to 2.10.5.1 mailing-list
- [zookeeper-issues] 20210116 [jira] [Commented] (ZOOKEEPER-4045) CVE-2020-25649 - Upgrade jackson databind to 2.10.5.1 mailing-list
- [flink-issues] 20210121 [GitHub] [flink-shaded] HuangXingBo opened a new pull request #93: [FLINK-21020][jackson] Bump version to 2.12.1 mailing-list
- [flink-issues] 20210122 [GitHub] [flink-shaded] HuangXingBo opened a new pull request #93: [FLINK-21020][jackson] Bump version to 2.12.1 mailing-list
- [tomee-commits] 20210127 [jira] [Created] (TOMEE-2965) CVE-2020-25649 - Update jackson databind mailing-list
- FEDORA-2021-1d8254899c vendor-advisory
- [karaf-commits] 20210217 [GitHub] [karaf] svogt opened a new pull request #1296: Update jackson-databind to fix CVE-2020-25649 / BDSA-2020-2965 mailing-list
- [karaf-commits] 20210217 [GitHub] [karaf] jbonofre merged pull request #1296: Update jackson-databind to fix CVE-2020-25649 / BDSA-2020-2965 mailing-list
- [karaf-commits] 20210217 [karaf] branch master updated: Update jackson-databind to fix CVE-2020-25649 / BDSA-2020-2965 mailing-list
- [karaf-commits] 20210217 [GitHub] [karaf] jbonofre commented on pull request #1296: Update jackson-databind to fix CVE-2020-25649 / BDSA-2020-2965 mailing-list
- [hive-issues] 20210223 [jira] [Assigned] (HIVE-24816) Upgrade jackson to 2.10.5.1 or 2.11.0+ due to CVE-2020-25649 mailing-list
- [hive-dev] 20210223 [jira] [Created] (HIVE-24816) Upgrade jackson to 2.10.5.1 or 2.11.0+ due to CVE-2020-25649 mailing-list
- [hive-issues] 20210223 [jira] [Updated] (HIVE-24816) Upgrade jackson to 2.10.5.1 or 2.11.0+ due to CVE-2020-25649 mailing-list
- [hive-issues] 20210223 [jira] [Work logged] (HIVE-24816) Upgrade jackson to 2.10.5.1 or 2.11.0+ due to CVE-2020-25649 mailing-list
- [hive-issues] 20210315 [jira] [Work logged] (HIVE-24816) Upgrade jackson to 2.10.5.1 or 2.11.0+ due to CVE-2020-25649 mailing-list
- [hive-issues] 20210316 [jira] [Work logged] (HIVE-24816) Upgrade jackson to 2.10.5.1 or 2.11.0+ due to CVE-2020-25649 mailing-list
- [turbine-commits] 20210316 svn commit: r1887732 - in /turbine/fulcrum/trunk/json: ./ jackson/ jackson/src/test/org/apache/fulcrum/json/jackson/ jackson2/ jackson2/src/test/org/apache/fulcrum/json/jackson/ jackson2/src/test/org/apache/fulcrum/json/jac mailing-list
- [iotdb-notifications] 20210324 [jira] [Created] (IOTDB-1256) Jackson have loopholes CVE-2020-25649 mailing-list
- [iotdb-reviews] 20210324 [GitHub] [iotdb] wangchao316 opened a new pull request #2896: [IOTDB-1256] Jackson have loopholes CVE-2020-25649 mailing-list
- [iotdb-reviews] 20210324 [GitHub] [iotdb] wangchao316 closed pull request #2896: [IOTDB-1256] Jackson have loopholes CVE-2020-25649 mailing-list
- [iotdb-commits] 20210325 [iotdb] branch master updated: [IOTDB-1256] upgrade Jackson to 2.11.0 because of loopholes CVE-2020-25649 (#2896) mailing-list
- [iotdb-reviews] 20210325 [GitHub] [iotdb] jixuan1989 merged pull request #2896: [IOTDB-1256] Jackson have loopholes CVE-2020-25649 mailing-list
- [hive-issues] 20210503 [jira] [Work logged] (HIVE-24816) Upgrade jackson to 2.10.5.1 or 2.11.0+ due to CVE-2020-25649 mailing-list
- [hive-issues] 20210510 [jira] [Work logged] (HIVE-24816) Upgrade jackson to 2.10.5.1 or 2.11.0+ due to CVE-2020-25649 mailing-list
- [hive-issues] 20210514 [jira] [Work logged] (HIVE-24816) Upgrade jackson to 2.10.5.1 or 2.11.0+ due to CVE-2020-25649 mailing-list
- [knox-dev] 20210601 [jira] [Created] (KNOX-2614) Upgrade Jackson due to CVE-2020-25649 mailing-list
- [knox-dev] 20210601 [jira] [Updated] (KNOX-2614) Upgrade jackson-databind to 2.10.5 due to CVE-2020-25649 mailing-list
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://lists.apache.org/thread.html/r31f4ee7d561d56a0c2c2c6eb1d6ce3e05917ff9654fdbfec05dc2b83%40%3Ccommits.servicecomb.apache.org%3E
- https://security.netapp.com/advisory/ntap-20210108-0007/
- [spark-user] 20210621 Re: CVEs mailing-list