FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Debian
  • Debian Linux
Fasterxml
  • Jackson-databind
Netapp
  • Active Iq Unified Manager
  • Oncommand Api Services
  • Service Level Manager
  • Snapcenter
  • Steelstore Cloud Integrated Storage
Oracle
  • Banking Platform
  • Communications Billing And Revenue Management
  • Communications Cloud Native Core Network Slice Selection Function
  • Communications Contacts Server
  • Communications Evolved Communications Application Server
  • Communications Instant Messaging Server
  • Communications Network Charging And Control
  • Customer Management And Segmentation Foundation
  • Enterprise Manager Base Platform
  • Global Lifecycle Management Opatch
  • Goldengate Application Adapters
  • Goldengate Stream Analytics
  • Jd Edwards Enterpriseone Orchestrator
  • Jd Edwards Enterpriseone Tools
  • Primavera Unifier
  • Retail Merchandising System
  • Retail Sales Audit
  • Retail Xstore Point Of Service
  • Siebel Engineering - Installer \& Deployment
  • Siebel Ui Framework
  • Trace File Analyzer
  • Webcenter Portal
  • Weblogic Server
Redhat
  • Amq Streams
  • Enterprise Linux
  • Jboss Enterprise Application Platform Cd
  • Jboss Enterprise Bpms Platform
  • Jboss Enterprise Brms Platform
  • Jboss Fuse
  • Jboss Single Sign On
  • Openshift Application Runtimes
  • Satellite
  • Satellite Capsule

Configuration 1 [-]

OR cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_contacts_server:8.0.0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_network_charging_and_control:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:goldengate_application_adapters:19.1.0.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:goldengate_stream_analytics:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*
cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_merchandising_system:15.0.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_merchandising_system:16.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_sales_audit:14.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:siebel_engineering_-_installer_\&_deployment:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:trace_file_analyzer:12.2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:trace_file_analyzer:18c:*:*:*:*:*:*:*
cpe:2.3:a:oracle:trace_file_analyzer:19c:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*

Configuration 3 [-]

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration 4 [-]

OR cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:linux:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
Package CPE Advisory Released Date
EAP-CD 19 Tech Preview
jackson-databind cpe:/a:redhat:jboss_enterprise_application_platform_cd:19 RHSA-2020:2333 2020-05-28T00:00:00Z
Red Hat AMQ Streams 1
jackson-databind cpe:/a:redhat:amq_streams:1 RHSA-2020:0939 2020-03-23T00:00:00Z
Red Hat Decision Manager 7
jackson-databind cpe:/a:redhat:jboss_enterprise_brms_platform:7.8 RHSA-2020:3196 2020-07-29T00:00:00Z
Red Hat Enterprise Linux 8
pki-core:10.6-8020020200326162741.c7c3114f cpe:/a:redhat:enterprise_linux:8 RHSA-2020:1644 2020-04-28T00:00:00Z
pki-deps:10.6-8020020191204213056.6a468ee4 cpe:/a:redhat:enterprise_linux:8 RHSA-2020:1644 2020-04-28T00:00:00Z
Red Hat Fuse 7.7.0
jackson-databind cpe:/a:redhat:jboss_fuse:7 RHSA-2020:3192 2020-07-28T00:00:00Z
Red Hat Process Automation 7
jackson-databind cpe:/a:redhat:jboss_enterprise_bpms_platform:7.8 RHSA-2020:3197 2020-07-29T00:00:00Z
Red Hat Satellite 6.6 for RHEL 7
candlepin-0:2.6.16-1.el7sat cpe:/a:redhat:satellite:6.6::el7 RHBA-2020:1494 2020-04-16T00:00:00Z
foreman-0:1.22.0.39-2.el7sat cpe:/a:redhat:satellite:6.6::el7 RHBA-2020:1494 2020-04-16T00:00:00Z
satellite-0:6.6.3-1.el7sat cpe:/a:redhat:satellite:6.6::el7 RHBA-2020:1494 2020-04-16T00:00:00Z
tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat cpe:/a:redhat:satellite:6.6::el7 RHBA-2020:1494 2020-04-16T00:00:00Z
tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat cpe:/a:redhat:satellite:6.6::el7 RHBA-2020:1494 2020-04-16T00:00:00Z
tfm-rubygem-katello-0:3.12.0.41-1.el7sat cpe:/a:redhat:satellite:6.6::el7 RHBA-2020:1494 2020-04-16T00:00:00Z
tfm-rubygem-runcible-0:2.13.0-1.el7sat cpe:/a:redhat:satellite:6.6::el7 RHBA-2020:1494 2020-04-16T00:00:00Z
candlepin-0:2.6.16-1.el7sat cpe:/a:redhat:satellite_capsule:6.6::el7 RHBA-2020:1494 2020-04-16T00:00:00Z
foreman-0:1.22.0.39-2.el7sat cpe:/a:redhat:satellite_capsule:6.6::el7 RHBA-2020:1494 2020-04-16T00:00:00Z
satellite-0:6.6.3-1.el7sat cpe:/a:redhat:satellite_capsule:6.6::el7 RHBA-2020:1494 2020-04-16T00:00:00Z
tfm-rubygem-fog-ovirt-0:1.2.3-1.el7sat cpe:/a:redhat:satellite_capsule:6.6::el7 RHBA-2020:1494 2020-04-16T00:00:00Z
tfm-rubygem-foreman_rh_cloud-0:0.9.4.1-2.el7sat cpe:/a:redhat:satellite_capsule:6.6::el7 RHBA-2020:1494 2020-04-16T00:00:00Z
tfm-rubygem-katello-0:3.12.0.41-1.el7sat cpe:/a:redhat:satellite_capsule:6.6::el7 RHBA-2020:1494 2020-04-16T00:00:00Z
tfm-rubygem-runcible-0:2.13.0-1.el7sat cpe:/a:redhat:satellite_capsule:6.6::el7 RHBA-2020:1494 2020-04-16T00:00:00Z
Red Hat Satellite 6.7 for RHEL 7
candlepin-0:2.9.28-1.el7sat cpe:/a:redhat:satellite:6.7::el7 RHBA-2020:3255 2020-07-30T00:00:00Z
foreman-0:1.24.1.24-1.el7sat cpe:/a:redhat:satellite:6.7::el7 RHBA-2020:3255 2020-07-30T00:00:00Z
foreman-installer-1:1.24.1.21-1.el7sat cpe:/a:redhat:satellite:6.7::el7 RHBA-2020:3255 2020-07-30T00:00:00Z
pulp-rpm-0:2.21.0.6-1.el7sat cpe:/a:redhat:satellite:6.7::el7 RHBA-2020:3255 2020-07-30T00:00:00Z
satellite-0:6.7.2-1.el7sat cpe:/a:redhat:satellite:6.7::el7 RHBA-2020:3255 2020-07-30T00:00:00Z
tfm-rubygem-fog-vsphere-0:3.2.1.1-1.el7sat cpe:/a:redhat:satellite:6.7::el7 RHBA-2020:3255 2020-07-30T00:00:00Z
tfm-rubygem-foreman_remote_execution-0:2.0.10.1-1.el7sat cpe:/a:redhat:satellite:6.7::el7 RHBA-2020:3255 2020-07-30T00:00:00Z
tfm-rubygem-foreman_rh_cloud-0:1.0.9-1.el7sat cpe:/a:redhat:satellite:6.7::el7 RHBA-2020:3255 2020-07-30T00:00:00Z
tfm-rubygem-foreman-tasks-0:0.17.5.6-1.el7sat cpe:/a:redhat:satellite:6.7::el7 RHBA-2020:3255 2020-07-30T00:00:00Z
tfm-rubygem-hammer_cli_foreman-0:0.19.6.5-1.el7sat cpe:/a:redhat:satellite:6.7::el7 RHBA-2020:3255 2020-07-30T00:00:00Z
tfm-rubygem-katello-0:3.14.0.25-1.el7sat cpe:/a:redhat:satellite:6.7::el7 RHBA-2020:3255 2020-07-30T00:00:00Z
candlepin-0:2.9.28-1.el7sat cpe:/a:redhat:satellite_capsule:6.7::el7 RHBA-2020:3255 2020-07-30T00:00:00Z
foreman-0:1.24.1.24-1.el7sat cpe:/a:redhat:satellite_capsule:6.7::el7 RHBA-2020:3255 2020-07-30T00:00:00Z
foreman-installer-1:1.24.1.21-1.el7sat cpe:/a:redhat:satellite_capsule:6.7::el7 RHBA-2020:3255 2020-07-30T00:00:00Z
pulp-rpm-0:2.21.0.6-1.el7sat cpe:/a:redhat:satellite_capsule:6.7::el7 RHBA-2020:3255 2020-07-30T00:00:00Z
satellite-0:6.7.2-1.el7sat cpe:/a:redhat:satellite_capsule:6.7::el7 RHBA-2020:3255 2020-07-30T00:00:00Z
tfm-rubygem-fog-vsphere-0:3.2.1.1-1.el7sat cpe:/a:redhat:satellite_capsule:6.7::el7 RHBA-2020:3255 2020-07-30T00:00:00Z
tfm-rubygem-foreman_remote_execution-0:2.0.10.1-1.el7sat cpe:/a:redhat:satellite_capsule:6.7::el7 RHBA-2020:3255 2020-07-30T00:00:00Z
tfm-rubygem-foreman_rh_cloud-0:1.0.9-1.el7sat cpe:/a:redhat:satellite_capsule:6.7::el7 RHBA-2020:3255 2020-07-30T00:00:00Z
tfm-rubygem-foreman-tasks-0:0.17.5.6-1.el7sat cpe:/a:redhat:satellite_capsule:6.7::el7 RHBA-2020:3255 2020-07-30T00:00:00Z
tfm-rubygem-hammer_cli_foreman-0:0.19.6.5-1.el7sat cpe:/a:redhat:satellite_capsule:6.7::el7 RHBA-2020:3255 2020-07-30T00:00:00Z
tfm-rubygem-katello-0:3.14.0.25-1.el7sat cpe:/a:redhat:satellite_capsule:6.7::el7 RHBA-2020:3255 2020-07-30T00:00:00Z
Red Hat Single Sign-On 7.3
jackson-databind cpe:/a:redhat:jboss_single_sign_on:7.3 RHSA-2020:0951 2020-03-23T00:00:00Z
Text-Only RHOAR
cpe:/a:redhat:openshift_application_runtimes:1.0 RHSA-2020:2067 2020-05-18T00:00:00Z
References
Link Providers
https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.10.1...jackson-databind-2.9.10.2 cve-icon cve-icon
https://github.com/FasterXML/jackson-databind/issues/2526 cve-icon cve-icon
https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d%40%3Cdev.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r2c77dd6ab8344285bd8e481b57cf3029965a4b0036eefccef74cdd44%40%3Cnotifications.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r3f8180d0d25a7c6473ebb9714b0c1d19a73f455ae70d0c5fefc17e6c%40%3Cissues.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r428735963bee7cb99877b88d3228e28ec28af64646455c4f3e7a3c94%40%3Cissues.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r50f513772f12e1babf65c7c2b9c16425bac2d945351879e2e267517f%40%3Cissues.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r5c14fdcabdeaba258857bcb67198652e4dce1d33ddc590cd81d82393%40%3Cdev.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r5c3644c97f0434d1ceb48ff48897a67bdbf3baf7efbe7d04625425b3%40%3Ccommits.druid.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r5d3d10fdf28110da3f9ac1b7d08d7e252f98d7d37ce0a6bd139a2e4f%40%3Cissues.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r67f4d4c48197454b83d62afbed8bebbda3764e6e3a6e26a848961764%40%3Ccommits.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r707d23bb9ee245f50aa909add0da6e8d8f24719b1278ddd99d2428b2%40%3Cissues.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r7a0821b44247a1e6c6fe5f2943b90ebc4f80a8d1fb0aa9a8b29a59a2%40%3Ccommits.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r7fb123e7dad49af5886cfec7135c0fd5b74e4c67af029e1dc91ba744%40%3Ccommits.druid.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r8831b7fa5ca87a1cf23ee08d6dedb7877a964c1d2bd869af24056a63%40%3Ccommits.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r909c822409a276ba04dc2ae31179b16f6864ba02c4f9911bdffebf95%40%3Cissues.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ra2e572f568de8df5ba151e6aebb225a0629faaf0476bf7c7ed877af8%40%3Cnotifications.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ra5ce96faec37c26b0aa15b4b6a8b1cbb145a748653e56ae83e9685d0%40%3Cnotifications.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ra8a80dbc7319916946397823aec0d893d24713cbf7b5aee0e957298c%40%3Cdev.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rb532fed78d031fff477fd840b81946f6d1200f93a63698dae65aa528%40%3Ccommits.druid.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rd1f346227e11fc515914f3a7b20d81543e51e5822ba71baa0452634a%40%3Cissues.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rd49cfa41bbb71ef33b53736a6af2aa8ba88c2106e30f2a34902a87d2%40%3Cnotifications.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rd6c6fef14944f3dcfb58d35f9317eb1c32a700e86c1b5231e45d3d0b%40%3Ccommits.druid.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rfa57d9c2a27d3af14c69607fb1a3da00e758b2092aa88eb6a51b6e99%40%3Cissues.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2020/02/msg00020.html cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2019-20330 cve-icon
https://security.netapp.com/advisory/ntap-20200127-0004/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2019-20330 cve-icon
https://www.oracle.com//security-alerts/cpujul2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuapr2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2020.html cve-icon cve-icon
History

Fri, 09 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2020-01-03T03:35:52.000Z

Updated: 2026-10-08T18:48:10.335Z

Reserved: 2020-01-03T00:00:00.000Z

Link: CVE-2019-20330

cve-icon Vulnrichment

Updated: 2024-08-05T02:39:09.617Z

cve-icon NVD

Status : Modified

Published: 2020-01-03T04:15:12.137

Modified: 2026-10-08T19:16:52.720

Link: CVE-2019-20330

cve-icon Redhat

Severity : Important

Publid Date: 2020-01-02T00:00:00Z

Links: CVE-2019-20330 - Bugzilla