CVE-2020-25649
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
- CVSS 3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - EPSS
- 18% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-25)
- CWE
- CWE-611
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:iotdb
- fasterxml:jackson-databind
- fedoraproject:fedora
- netapp:oncommand_api_services
- netapp:oncommand_workflow_automation
- netapp:service_level_manager
- oracle:agile_product_lifecycle_management
- oracle:agile_product_lifecycle_management_integration_pack
- oracle:banking_apis
- oracle:banking_platform
- oracle:banking_treasury_management
- oracle:blockchain_platform
- oracle:coherence
- oracle:commerce_platform
- oracle:communications_billing_and_revenue_management
- oracle:communications_cloud_native_core_unified_data_repository
- oracle:communications_convergent_charging_controller
- oracle:communications_evolved_communications_application_server
- oracle:communications_instant_messaging_server
- oracle:communications_interactive_session_recorder
- oracle:communications_messaging_server
- oracle:communications_network_charging_and_control
- oracle:communications_offline_mediation_controller
- oracle:communications_pricing_design_center
- oracle:communications_services_gatekeeper
- oracle:communications_unified_inventory_management
- oracle:goldengate_application_adapters
- oracle:health_sciences_empirica_signal
- oracle:insurance_policy_administration
- oracle:insurance_rules_palette
- oracle:jd_edwards_enterpriseone_orchestrator
- oracle:jd_edwards_enterpriseone_tools
- oracle:primavera_gateway
- oracle:retail_service_backbone
- oracle:retail_xstore_point_of_service
- oracle:sd-wan_edge
- oracle:utilities_framework
- oracle:webcenter_portal
- quarkus:quarkus
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-288c-cq4h-88gq | Maven | com.fasterxml.jackson.core:jackson-databind | >=2.6.0 <2.6.7.4 | 2.6.7.4 |
| GHSA-288c-cq4h-88gq | Maven | com.fasterxml.jackson.core:jackson-databind | >=2.7.0.0 <2.9.10.7 | 2.9.10.7 |
| GHSA-288c-cq4h-88gq | Maven | com.fasterxml.jackson.core:jackson-databind | >=2.10.0.0 <2.10.5.1 | 2.10.5.1 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1887664
- https://github.com/FasterXML/jackson-databind/issues/2589
- https://lists.apache.org/thread.html/r011d1430e8f40dff9550c3bc5d0f48b14c01ba8aecabd91d5e495386%40%3Ccommits.turbine.apache.org%3E
- https://lists.apache.org/thread.html/r024b7bda9c43c5560d81238748775c5ecfe01b57280f90df1f773949%40%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/r04529cedaca40c2ff90af4880493f9c88a8ebf4d1d6c861d23108a5a%40%3Cnotifications.zookeeper.apache.org%3E