XML External Entity injection in jackson-databind - CVE-2020-25649

Vulnerability identifier: #VU48979

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-25649

CWE-ID: CWE-611

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to modify information on the system.

The vulnerability exists due to insufficient validation of user-supplied XML input. A remote attacker can pass a specially crafted XML code to the affected application and modify information on the system.

jackson-databind
CICS Transaction Gateway
z/Transaction Processing Facility ( z/TPF)
Log Analysis
IBM Process Mining
Agile Product Lifecycle Management Integration Pack for Oracle E-Business Suite
Jira Service Management Data Center
Jira Service Management Server
Red Hat Decision Manager
Confluence Data Center
Oracle Communications Unified Inventory Management
Oracle Health Sciences Empirica Signal
Oracle SD-WAN Edge
Bamboo Server
Jira Software Data Center
Oracle Banking Treasury Management
Oracle Banking APIs
IBM Watson Assistant for IBM Cloud Pak for Data
Unified Mediation Bus
Bitbucket Data Center
IBM Cloud Application Performance Management (APM)
IBM Security Verify Governance
EMC Data Protection Advisor
ClevOS
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Enterprise Storage
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server for SAP Applications
openSUSE Leap
Fedora
AMQ Streams
Oracle Communications Evolved Communications Application Server
Oracle Coherence
Primavera Gateway
Bitbucket Server
Oracle Insurance Policy Administration Operational Data Store for Life and Annuity
Oracle Insurance Policy Administration
Oracle Managed File Transfer
Oracle Communications Cloud Native Core Unified Data Repository
IBM Spectrum Protect for Space Management
Oracle Banking Platform
Cloudera Observability with IBM
Oracle Utilities Framework
Oracle Insurance Rules Palette
Oracle Communications Network Charging and Control
Oracle Data Integrator
Oracle Retail Service Backbone
Oracle Retail Xstore Point of Service
Integration Designer
DB2 on Cloud Pak for Data
DB2 Warehouse on Cloud Pak for Data
IBM Engineering Requirements Management DOORS Next
Engineering Lifecycle Management - Jazz Foundation
Storage Virtualize
IBM Sterling Order Management
Red Hat Virtualization Manager
Red Hat OpenShift Container Platform
JD Edwards EnterpriseOne Tools
Primavera Unifier
Oracle GoldenGate Application Adapters
Oracle Autovue for Agile Product Lifecycle Management
IBM Disconnected Log Collector
IBM Tivoli Network Manager (ITNM)
IBM Spectrum Protect Backup-Archive Client
Crowd Server
Oracle Communications Interactive Session Recorder
Oracle Communications Billing and Revenue Management
Oracle Communications Services Gatekeeper
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
Confluence Server
IBM Qradar SIEM
Jira Software Server
IBM Security Verify Access
JD Edwards EnterpriseOne Orchestrator
Oracle Agile PLM Framework
IBM Security Guardium
IBM Spectrum Protect for Virtual Environments: Data Protection for VMware
IBM Spectrum Protect for Virtual Environments: Data Protection for Hyper-V
Oracle Commerce Platform
Oracle Communications Convergent Charging Controller
Oracle WebCenter Portal
rhv-log-collector-analyzer (Red Hat package)
vdsm-jsonrpc-java (Red Hat package)
ovirt-web-ui (Red Hat package)
rh-maven35-jackson-databind (Red Hat package)
jackson-databind
jackson-bom
jackson-dataformats-binary-javadoc
jackson-dataformat-cbor
jackson-dataformat-smile
jackson-dataformats-binary
jackson-core-javadoc
jackson-core
jackson-annotations
jackson-annotations-javadoc
jackson-databind-javadoc
ovirt-engine-dwh (Red Hat package)
ovirt-engine (Red Hat package)
rhvm-branding-rhv (Red Hat package)
Operational Decision Manager

Install updates from vendor's website.

jackson-databind - update to 2.10.5.1
AMQ Streams - update to 1.7.0
Log Analysis - addressed in versions 1.3.7.2 IF001, 1.3.7.2 IF002, 1.3.7.2 IF003
IBM Process Mining - update to 1.12.0.4
Cloudera Observability with IBM - update to 3.6.2
Red Hat OpenShift Container Platform - update to 4.6.27
Jira Service Management Data Center - addressed in versions 4.20.28, 5.4.12
Jira Service Management Server - addressed in versions 4.20.28, 5.4.12
Crowd Server - addressed in versions 5.0.8, 5.1.6, 5.2.1
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.11.0
Red Hat Decision Manager - update to 7.11.0
Confluence Server - addressed in versions 7.19.17, 8.3.4, 8.4.5, 8.5.4, 8.6.2
Confluence Data Center - addressed in versions 7.19.17, 8.3.4, 8.4.5, 8.5.4, 8.6.2, 8.7.1
IBM Qradar SIEM - addressed in versions 7.3.3 Fix Pack 8, 7.4.3 Fix Pack 1
Bamboo Server - addressed in versions 9.2.7, 9.3.5
Jira Software Server - update to 9.4.13
Jira Software Data Center - update to 9.4.13
rhv-log-collector-analyzer (Red Hat package) - update to 1.0.6-1.el8ev
IBM Disconnected Log Collector - update to 1.6
vdsm-jsonrpc-java (Red Hat package) - update to 1.6.0-1.el8ev
ovirt-web-ui (Red Hat package) - update to 1.6.6-1.el8ev
rh-maven35-jackson-databind (Red Hat package) - update to 2.7.6-2.12.el7
jackson-databind - update to 2.10.5.1-1.fc32
jackson-bom - update to 2.13.0-150200.3.3.1
jackson-dataformats-binary-javadoc - update to 2.13.0-150200.3.3.3
jackson-dataformat-cbor - update to 2.13.0-150200.3.3.3
jackson-dataformat-smile - update to 2.13.0-150200.3.3.3
jackson-dataformats-binary - update to 2.13.0-150200.3.3.3
jackson-core-javadoc - update to 2.13.0-150200.3.6.1
jackson-core - update to 2.13.0-150200.3.6.1
jackson-annotations - update to 2.13.0-150200.3.6.1
jackson-annotations-javadoc - update to 2.13.0-150200.3.6.1
jackson-databind-javadoc - update to 2.13.0-150200.3.9.1
jackson-databind - update to 2.13.0-150200.3.9.1
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.0.0
IBM Tivoli Network Manager (ITNM) - update to 4.2.0.16
Unified Mediation Bus - update to 4.4
ovirt-engine-dwh (Red Hat package) - update to 4.4.4.2-1.el8ev
ovirt-engine (Red Hat package) - update to 4.4.4.5-0.10.el8ev
rhvm-branding-rhv (Red Hat package) - update to 4.4.7-1.el8ev
DB2 on Cloud Pak for Data - update to 4.8.5
DB2 Warehouse on Cloud Pak for Data - update to 4.8.5
IBM Engineering Requirements Management DOORS Next - addressed in versions 7.0.3 ifix 20, 7.1.0 ifix 6
Engineering Lifecycle Management - Jazz Foundation - addressed in versions 7.0.3 iFix020, 7.1.0 iFix006
Bitbucket Server - addressed in versions 7.21.18, 8.9.7, 8.11.6, 8.12.4, 8.13.3, 8.14.2
Bitbucket Data Center - addressed in versions 7.21.18, 8.9.7, 8.11.6, 8.12.4, 8.13.3, 8.14.2
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
IBM Spectrum Protect for Virtual Environments: Data Protection for VMware - update to 8.1.15.2
IBM Spectrum Protect for Space Management - update to 8.1.15.2
IBM Spectrum Protect Backup-Archive Client - update to 8.1.15.2
IBM Spectrum Protect for Virtual Environments: Data Protection for Hyper-V - update to 8.1.15.2
Storage Virtualize - addressed in versions 8.6.3.0, 8.7.0.0
Operational Decision Manager - addressed in versions 8.10.5.2 Interim fix 1, 8.11.0.1 Interim fix 30, 8.11.1 Interim fix 24, 8.12.0.1 Interim fix 5
IBM Security Verify Governance - update to 10.0.1.0.4
IBM Sterling Order Management - update to 10.0.2309.0
EMC Data Protection Advisor - update to 19.10 B46

• https://bugzilla.redhat.com/show_bug.cgi?id=1887664
• https://github.com/FasterXML/jackson-databind/issues/2589
• https://lists.apache.org/thread.html/r1b7ed0c4b6c4301d4dfd6fdbc5581b0a789d3240cab55d766f33c6c6@%3Cjira.kafka.apache.org%3E
• https://lists.apache.org/thread.html/r2882fc1f3032cd7be66e28787f04ec6f1874ac68d47e310e30ff7eb1@%3Cjira.kafka.apache.org%3E
• https://lists.apache.org/thread.html/r2b6ddb3a4f4cd11d8f6305011e1b7438ba813511f2e3ab3180c7ffda@%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/r63c87aab97155f3f3cbe11d030c4a184ea0de440ee714977db02e956@%3Cjira.kafka.apache.org%3E
• https://lists.apache.org/thread.html/ra1157e57a01d25e36b0dc17959ace758fc21ba36746de29ba1d8b130@%3Cjira.kafka.apache.org%3E
• https://lists.apache.org/thread.html/rc15e90bbef196a5c6c01659e015249d6c9a73581ca9afb8aeecf00d2@%3Cjira.kafka.apache.org%3E
• https://lists.apache.org/thread.html/rc959cdb57c4fe198316130ff4a5ecbf9d680e356032ff2e9f4f05d54@%3Cjira.kafka.apache.org%3E
• https://lists.apache.org/thread.html/rd317f15a675d114dbf5b488d27eeb2467b4424356b16116eb18a652d@%3Cjira.kafka.apache.org%3E
• https://lists.apache.org/thread.html/re96dc7a13e13e56190a5d80f9e5440a0d0c83aeec6467b562fbf2dca@%3Cjira.kafka.apache.org%3E

• XXE in FasterXML Jackson-databind
• Red Hat Virtualization Manager update for FasterXML jackson-databind
• Multiple vulnerabilities in Oracle Utilities Framework
• XXE in Red Hat AMQ Streams
• Multiple vulnerabilities in Oracle SD-WAN Edge
• Multiple vulnerabilities in Oracle Communications Interactive Session Recorder
• Multiple vulnerabilities in Oracle Banking Platform
• Multiple vulnerabilities in Oracle Coherence
• XML External Entity injection in Oracle Health Sciences Empirica Signal
• Multiple vulnerabilities in Red Hat OpenShift Container Platform
• Multiple vulnerabilities in Red Hat Process Automation Manager
• Multiple vulnerabilities in Red Hat Decision Manager
• Multiple vulnerabilities in Oracle Commerce Platform
• Multiple vulnerabilities in Oracle Communications Network Charging and Control
• XML External Entity injection in Oracle Communications Convergent Charging Controller
• Multiple vulnerabilities in Oracle Communications Billing and Revenue Management
• Multiple vulnerabilities in Oracle Communications Unified Inventory Management
• Multiple vulnerabilities in Oracle Communications Evolved Communications Application Server
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Multiple vulnerabilities in Oracle Communications Services Gatekeeper
• Multiple vulnerabilities in Primavera Unifier
• Multiple vulnerabilities in Primavera Gateway
• Multiple vulnerabilities in Oracle Banking Treasury Management
• XML External Entity injection in Oracle GoldenGate Application Adapters
• XML External Entity injection in Oracle Insurance Rules Palette
• Multiple vulnerabilities in Oracle Insurance Policy Administration
• Multiple vulnerabilities in JD Edwards EnterpriseOne Tools
• Multiple vulnerabilities in JD Edwards EnterpriseOne Orchestrator
• XML External Entity injection in Oracle Retail Service Backbone
• Multiple vulnerabilities in Oracle Retail Xstore Point of Service
• XML External Entity injection in Oracle Data Integrator
• IBM Security Guardium update for FasterXML jackson-databind
• XML External Entity injection in Agile Product Lifecycle Management Integration Pack for Oracle E-Business Suite
• Multiple vulnerabilities in Oracle Banking APIs
• Multiple vulnerabilities in Oracle WebCenter Portal
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in Oracle Agile PLM Framework
• Multiple vulnerabilities in IBM Security Access Manager
• Multiple vulnerabilities in Oracle Autovue for Agile Product Lifecycle Management
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Multiple vulnerabilities in IBM QRadar SIEM
• XXE in IBM Watson Assistant for IBM Cloud Pak for Data
• ClevOS update for IBM Cloud Object Storage Systems
• Multiple vulnerabilities in IBM Spectrum Protect Backup-Archive Client, IBM Spectrum Protect for Space Management, and IBM Spectrum Protect for Virtual Environments
• Multiple vulnerabilities in z/Transaction Processing Facility
• IBM Log Analysis update for FasterXML jackson-databind
• Multiple vulnerabilities in IBM CICS Transaction Gateway
• Red Hat Software Collections update for rh-maven35-jackson-databind
• Multiple vulnerabilities in IBM Tivoli Network Manager (ITNM)
• SUSE update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in Oracle Insurance Policy Administration Operational Data Store for Life and Annuity
• Multiple vulnerabilities in IBM Application Performance Management products
• Multiple vulnerabilities in IBM Sterling Order Management
• Atlassian Bamboo Data Center and Server update for third-party applications
• Atlassian Jira Data Center and Server update for third-party software
• Atlassian Jira Service Management Data Center and Server update for third-party software
• Atlassian Crowd Data Center and Server update for third-party software
• Atlassian Confluence Data Center and Server update for third-party software
• Atlassian Bitbucket Data Center and Server update for third-party software
• Multiple vulnerabilities in HPE Unified Mediation Bus (UMB)
• Multiple vulnerabilities in IBM Integration Designer
• Multiple vulnerabilities in IBM Operational Decision Manager
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data
• Multiple vulnerabilities in IBM Storage Virtualize
• Multiple vulnerabilities in Data Protection Advisor
• Fedora 32 update for jackson-databind
• Multiple vulnerabilities in Oracle Managed File Transfer
• Multiple vulnerabilities in Cloudera Observability on Premises with IBM
• Multiple vulnerabilities in IBM Engineering Lifecycle Management - Jazz Foundation
• IBM Engineering Requirements Management DOORS Next update for FasterXML Jackson Databind