PT-2020-3307 · Oracle+10 · Retail Merchandising System+36

Published 2020-02-10 · Updated 2025-06-25 · CVE-2020-9546

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.x before 2.9.10.4 oracle weblogic server (affected versions not specified) oracle retail xstore point of service (affected versions not specified) oracle retail service backbone (affected versions not specified) oracle retail sales audit (affected versions not specified) oracle retail merchandising system (affected versions not specified) oracle primavera unifier (affected versions not specified) oracle jd edwards enterpriseone tools (affected versions not specified) oracle jd edwards enterpriseone orchestrator (affected versions not specified) oracle insurance policy administration j2ee (affected versions not specified) oracle global lifecycle management opatch (affected versions not specified) oracle financial services retail customer analytics (affected versions not specified) oracle financial services price creation and discovery (affected versions not specified) oracle financial services institutional performance analytics (affected versions not specified) oracle financial services analytical applications infrastructure (affected versions not specified) oracle enterprise manager base platform (affected versions not specified) oracle communications session route manager (affected versions not specified) oracle communications session report manager (affected versions not specified) oracle communications network charging and control (affected versions not specified) oracle communications instant messaging server (affected versions not specified) oracle communications evolved communications application server (affected versions not specified) oracle communications element manager (affected versions not specified) oracle communications diameter signaling router (affected versions not specified) oracle communications contacts server (affected versions not specified) oracle communications calendar server (affected versions not specified) oracle banking platform (affected versions not specified) oracle banking digital experience (affected versions not specified) oracle autovue for agile product lifecycle management (affected versions not specified) oracle agile plm (affected versions not specified) netapp active iq unified manager (affected versions not specified) debian debian linux (affected versions not specified)

Description The issue is related to the interaction between serialization gadgets and typing in the FasterXML jackson-databind library, specifically with the org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig component. This can lead to a denial-of-service condition when exploited by a remote attacker.

Recommendations For FasterXML jackson-databind versions 2.x before 2.9.10.4, update to version 2.9.10.4 or later. For oracle weblogic server, oracle retail xstore point of service, oracle retail service backbone, oracle retail sales audit, oracle retail merchandising system, oracle primavera unifier, oracle jd edwards enterpriseone tools, oracle jd edwards enterpriseone orchestrator, oracle insurance policy administration j2ee, oracle global lifecycle management opatch, oracle financial services retail customer analytics, oracle financial services price creation and discovery, oracle financial services institutional performance analytics, oracle financial services analytical applications infrastructure, oracle enterprise manager base platform, oracle communications session route manager, oracle communications session report manager, oracle communications network charging and control, oracle communications instant messaging server, oracle communications evolved communications application server, oracle communications element manager, oracle communications diameter signaling router, oracle communications contacts server, oracle communications calendar server, oracle banking platform, oracle banking digital experience, oracle autovue for agile product lifecycle management, oracle agile plm, netapp active iq unified manager, and debian debian linux, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

ALSA-2020:1644

ALT-PU-2021-1792

BDU:2020-03616

BDU:2020-03617

BDU:2020-03618

BDU:2021-01572

CESA-2020_1644

CVE-2020-9546

DLA-2135-1

GHSA-5P34-5M6P-P58G

MGASA-2021-0153

RHSA-2020:1644

RHSA-2020:2511

RHSA-2020:2512

RHSA-2020:2513

RHSA-2020:3637

RHSA-2020:3638

RHSA-2020:3639

RHSA-2020:4366

RHSA-2020_1644

RHSA-2025:1746

RLSA-2020:1644

ROSA-SA-2025-2629

USN-4813-1

Affected Products

Alt Linux

Almalinux

Centos

Debian

Red Hat

Red Os

Rocky Linux

Ubuntu

Active Iq Unified Manager

Agile Plm

Autovue For Agile Product Lifecycle Management

Banking Digital Experience

Banking Platform

Communications Calendar Server

Communications Contacts Server

Oracle Communications Diameter Signaling Router

Communications Element Manager

Communications Evolved Communications Application Server

Communications Instant Messaging Server

Communications Network Charging/Control

Communications Session Report Manager

Enterprise Manager Base Platform

Oracle Financial Services Analytical Applications Infrastructure

Financial Services Institutional Performance Analytics

Oracle Financial Services Price Creation/Discovery

Financial Services Retail Customer Analytics

Global Lifecycle Management Opatch

Insurance Policy Administration J2Ee

Jackson-Databind

Jd Edwards Enterpriseone Orchestrator

Jd Edwards Enterpriseone Tools

Primavera Unifier

Retail Merchandising System

Retail Sales Audit

Retail Service Backbone

Retail Xstore Point Of Service

Oracle Weblogic Server

References · 152

• 🔥 https://anquanke.com/post/id/200010 · Exploit
• https://github.com/FasterXML/jackson-databind/issues/2631 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-9546 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-9548 · Vendor Advisory
• https://debian.org/lts/security/2019/dla-2030 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14195 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-9547 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-8840 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14379 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4813-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0153 · Vendor Advisory
• https://debian.org/lts/security/2020/dla-2135 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2021.html · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/6X2UT4X6M7DLQYBOOHMXBWGYJ65RL2CT · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0153.html · Security Note