This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-10650 →

DEBIAN-CVE-2020-10650

A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignit...

Original description

The description as published by the source.

A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 jackson-databind

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1-1"}]}]

Debian:13 jackson-databind

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1-1"}]}]

Debian:14 jackson-databind

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1-1"}]}]

References

advisory security-tracker.debian.org