CVE-2020-8840: jackson-databind from 2.0.0 (inclusive), before 2.7.9.7 (exclusive), from 2.8.0 (inclusive), before 2.8.11.5…

Affected technology

jackson-databind · from 2.0.0 (inclusive), before 2.7.9.7 (exclusive)
fasterxml

jackson-databind · from 2.8.0 (inclusive), before 2.8.11.5 (exclusive)
fasterxml

jackson-databind · from 2.9.0 (inclusive), before 2.9.10.3 (exclusive)
fasterxml

debian linux · 8.0
debian

oncommand api services · Version not applicable in the source CPE
netapp

oncommand workflow automation · Version not applicable in the source CPE
netapp

service level manager · Version not applicable in the source CPE
netapp

steelstore cloud integrated storage · Version not applicable in the source CPE
netapp

oceanstor 9000 firmware · v300r006c20
huawei

oceanstor 9000 firmware · v300r006c20spc100
huawei

oceanstor 9000 firmware · v300r006c20spc200
huawei

oceanstor 9000 firmware · v300r006c20spc300
huawei

global lifecycle management opatch · before 11.2.0.3.23 (exclusive)
oracle

global lifecycle management opatch · from 12.2.0.1.0 (inclusive), before 12.2.0.1.19 (exclusive)
oracle

global lifecycle management opatch · from 13.9.4.0.0 (inclusive), before 13.9.4.2.1 (exclusive)
oracle

n/a · n/a
Vendor not specified by the source

Description’s affected range: through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

NVD’s CVSS 3.1 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.