Input validation error in Jackson Dataformats Binary - CVE-2020-28491

Vulnerability identifier: #VU60986

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-28491

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Jackson Dataformats Binary
IBM Observability with Instana
Log Analysis
OpenShift Logging
Autodesk Infraworks
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Enterprise Storage
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Desktop
openSUSE Leap
openEuler
IBM Security Verify Access
IBM Security Guardium
Oracle WebLogic Server
Fuse
watsonx.data
jackson-dataformats-binary
jackson-bom
jackson-dataformat-cbor
jackson-dataformat-smile
jackson-dataformats-binary-javadoc
jackson-annotations
jackson-annotations-javadoc
jackson-core
jackson-core-javadoc
jackson-databind
jackson-databind-javadoc
CloudLink
Storage Virtualize
IBM Sterling Order Management

Install updates from vendor's website.

Jackson Dataformats Binary - addressed in versions 2.11.4, 2.12.1
Log Analysis - update to 1.3.7.2 IF003
OpenShift Logging - addressed in versions 5.1.9, 5.2.8
Autodesk Infraworks - addressed in versions 2021.2 Hotfix 9, 2023.1 Hotfix 1
watsonx.data - update to 2.0.2
jackson-dataformats-binary - update to 2.9.4-6
jackson-bom - update to 2.13.0-150200.3.3.1
jackson-dataformat-cbor - update to 2.13.0-150200.3.3.3
jackson-dataformat-smile - update to 2.13.0-150200.3.3.3
jackson-dataformats-binary - update to 2.13.0-150200.3.3.3
jackson-dataformats-binary-javadoc - update to 2.13.0-150200.3.3.3
jackson-annotations - update to 2.13.0-150200.3.6.1
jackson-annotations-javadoc - update to 2.13.0-150200.3.6.1
jackson-core - update to 2.13.0-150200.3.6.1
jackson-core-javadoc - update to 2.13.0-150200.3.6.1
jackson-databind - update to 2.13.0-150200.3.9.1
jackson-databind-javadoc - update to 2.13.0-150200.3.9.1
Fuse - update to 7.10.0
CloudLink - update to 8.0-3.10.5.1
Storage Virtualize - addressed in versions 8.6.3.0, 8.7.0.0
IBM Sterling Order Management - update to 10.0.2309.0

• https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONDATAFORMAT-1047329
• https://github.com/FasterXML/jackson-dataformats-binary/commit/de072d314af8f5f269c8abec6930652af67bc8e6
• https://github.com/FasterXML/jackson-dataformats-binary/issues/186

• Denial of service in FasterXML Jackson Dataformats Binary
• Multiple vulnerabilities in OpenShift Logging
• Multiple vulnerabilities in IBM Security Guardium
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in IBM Security Access Manager
• IBM Log Analysis update for FasterXML jackson-dataformat-cbor
• SUSE update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core
• Multiple vulnerabilities in Autodesk InfraWorks
• Multiple vulnerabilities in Dell CloudLink
• Multiple vulnerabilities in IBM Sterling Order Management
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
• openEuler 20.03 LTS SP1 update for jackson-dataformats-binary
• Multiple vulnerabilities in IBM Storage Virtualize
• Input validation error in IBM watsonx.data
• Multiple vulnerabilities in Fuse 7.10