Out-of-bounds write in jackson-databind - CVE-2020-36518

Vulnerability identifier: #VU61799

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-36518

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing untrusted input. A remote attacker can trigger out-of-bounds write and cause a denial of service condition on the target system.

jackson-databind
IBM Cloud Pak for Watson AIOps
B2B Advanced Communications
IBM i Modernization Engine for Lifecycle Integration
IBM Watson Machine Learning Accelerator
Oracle Banking Platform
Cloudera Observability with IBM
Oracle Utilities Framework
RecoverPoint Classic
Oracle Business Intelligence Enterprise Edition
IBM Business Automation Manager Open Editions
Oracle Financial Services Analytical Applications Infrastructure
Datacap
IBM MQ Appliance
IBM Engineering Requirements Management DOORS Next
Oracle Communications Policy Management
Oracle Retail Service Backbone
Integration Designer
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
IBM Engineering Lifecycle Optimization - Publishing
Engineering Lifecycle Management - Jazz Foundation
Storage Virtualize
Dell Data Protection Central
Robotic Process Automation for Cloud Pak
Oracle Linux
Debian Linux
Solaris Cluster
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Enterprise Storage
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Anolis OS
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Basesystem
openSUSE Leap
openEuler
CICS Transaction Gateway
z/Transaction Processing Facility ( z/TPF)
Log Analysis
IBM Process Mining
IBM Cloud Transformation Advisor
Oracle Banking Party Management
Oracle Banking Loans Servicing
Oracle Banking Enterprise Default Management
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Jira Service Management Data Center
Jira Service Management Server
Dell Secure Connect Gateway
OpenShift Logging
Crowd Data Center
UCD - IBM UrbanCode Deploy
Jira Software Data Center
Oracle Financial Services Behavior Detection Platform
Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition
Oracle Financial Services Enterprise Case Management
IBM Business Process Manager
IBM Common Licensing
Oracle SD-WAN Edge
Oracle Health Sciences Empirica Signal
IBM Integration Bus
Enterprise Manager Base Platform
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
Primavera P6 Enterprise Project Portfolio Management
Oracle Blockchain Platform
Oracle Communications Cloud Native Core Network Repository Function
Oracle Communications Cloud Native Core Binding Support Function
Splunk AppDynamics Database Agent
Autodesk Infraworks
IBM MQ
Netcool Operations Insight
Red Hat Integration Camel-K
Financial Transaction Manager for ACH Services and Check Services
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Sterling B2B Integrator
IBM Maximo Asset Management
IBM Cloud Application Performance Management (APM)
IBM Security Verify Governance
EMC Data Protection Advisor
NetWorker
Oracle Graph Server and Client
API Gateway
AMQ Broker
Oracle Communications Evolved Communications Application Server
JBoss Enterprise Application Platform
Oracle WebLogic Server
Oracle Coherence
Primavera Gateway
AMQ Streams
API Manager
IBM Data Risk Manager
Oracle Financial Services Crime and Compliance Management Studio
Documaker Enterprise Edition
Oracle Global Lifecycle Management NextGen OUI Framework
Stream Analytics
Oracle Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Network Slice Selection Function
Oracle Communications Cloud Native Core Unified Data Repository
Oracle Communications Cloud Native Core Service Communication Proxy
IBM Cloud Pak System
Quarkus
Siebel UI Framework
Oracle Healthcare Translational Research
Oracle Communications Pricing Design Center
Oracle WebCenter Portal
Oracle Retail Sales Audit
Vert.x
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
Oracle Communications Services Gatekeeper
Oracle Communications Instant Messaging Server
Oracle Communications Billing and Revenue Management
Voice Gateway
Red Hat Single Sign-On
SecurID Authentication Manager
Oracle Access Manager
IBM Qradar SIEM
Jira Software Server
JBoss Data Grid
IBM Cognos Command Center
Cloud Pak for Security (CP4S)
Jazz Reporting Service
Splunk Enterprise
PeopleSoft Enterprise PeopleTools
Oracle AutoVue
Operational Decision Manager
JD Edwards EnterpriseOne Tools
Enterprise Manager for Virtualization
Primavera Unifier
Oracle Autovue for Agile Product Lifecycle Management
IBM Disconnected Log Collector
IBM Tivoli Network Manager (ITNM)
JD Edwards EnterpriseOne Orchestrator
Oracle Agile PLM Framework
IBM App Connect Enterprise
Oracle Commerce Platform
Oracle Commerce Guided Search
Oracle Retail Merchandising System
IBM Security Guardium
rh-sso7-keycloak (Red Hat package)
xsom
bea-stax-api
glassfish-fastinfoset
xml-commons-resolver
xml-commons-apis
rh-sso7 (Red Hat package)
xmlstreambuffer
stax-ex
velocity
slf4j-jdk14
slf4j
QuMagie Mobile
glassfish-jaxb-txw2
glassfish-jaxb-runtime
glassfish-jaxb-core
glassfish-jaxb-api
apache-commons-lang
xalan-j2
jackson-module-jaxb-annotations
jackson-databind
jackson-databind-javadoc
xerces-j2
jackson-databind (Debian package)
jackson-bom
jackson-dataformats-binary-javadoc
jackson-dataformats-binary
jackson-dataformat-smile
jackson-dataformat-cbor
jackson-annotations
jackson-core-javadoc
jackson-core
jackson-annotations-javadoc
jackson-parent
jackson-annotations (Red Hat package)
jackson-modules-base (Red Hat package)
jackson-core (Red Hat package)
jackson-databind (Red Hat package)
jackson-jaxrs-providers (Red Hat package)
jackson-jaxrs-json-provider
jackson-jaxrs-providers
resteasy
jakarta-commons-httpclient
apache-commons-collections
apache-commons-net
javassist-javadoc
javassist
idm-jss-javadoc
idm-jss
idm-ldapjdk-javadoc
idm-ldapjdk
rh-sso7-javapackages-tools (Red Hat package)
idm-tomcatjss
pki-servlet-engine
python3-idm-pki
idm-pki-tools
idm-pki-kra
idm-pki-symkey
idm-pki-acme
idm-pki-base
idm-pki-base-java
idm-pki-server
idm-pki-ca
fasterxml-oss-parent
relaxngDatatype
Oracle Database Server
Big Data Spatial and Graph
Cloud Foundry UAA
Bosh Release for the UAA
IBM Supplied MQ Advanced Queue Manager Container images
watsonx.data
Vue PACS
Oracle Spatial Studio

Install updates from vendor's website.

jackson-databind - addressed in versions 2.12.6.1, 2.13.2.1
API Gateway - update to May 2022
API Manager - update to May 2022
B2B Advanced Communications - update to 1.0.0.12
IBM i Modernization Engine for Lifecycle Integration - update to 1.0.1
Log Analysis - addressed in versions 1.3.7.2 IF001, 1.3.7.2 IF002, 1.3.7.2 IF003
IBM Process Mining - update to 1.13.0.0
IBM Cloud Transformation Advisor - update to 3.2.0
IBM Data Risk Manager - update to 2.0.6.15
IBM Cloud Pak System - update to 2.3.3.6
Quarkus - update to 2.7.6
Cloudera Observability with IBM - update to 3.6.2
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.0.7
Vert.x - update to 4.2.7
Jira Service Management Data Center - addressed in versions 4.20.27, 5.4.11
Jira Service Management Server - addressed in versions 4.20.27, 5.4.11
Dell Secure Connect Gateway - update to 5.14.00.10
RecoverPoint Classic - update to 5.1 SP4 P4
OpenShift Logging - addressed in versions 5.3.14, 5.4.8, 5.5.5, 5.6.0
AMQ Broker - update to 7.10.0
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.13.1
Crowd Data Center - update to 7.1.1
UCD - IBM UrbanCode Deploy - addressed in versions 6.2.7.16, 7.0.5.11, 7.1.2.7, 7.2.3.0
JBoss Enterprise Application Platform - update to 7.4.5
Red Hat Single Sign-On - addressed in versions 7.5.3, 7.6.1
IBM Qradar SIEM - update to 7.5.0 Update Pack 6
Splunk Enterprise - addressed in versions 8.1.12, 8.2.9, 9.0.2
IBM Business Automation Manager Open Editions - update to 8.0.1
Jira Software Server - addressed in versions 8.20.28, 9.4.12, 9.11.3
Jira Software Data Center - addressed in versions 8.20.28, 9.4.12, 9.11.3
JBoss Data Grid - update to 8.3.1
SecurID Authentication Manager - addressed in versions 8.6 Patch 4, 8.7 Patch 1
Datacap - update to 9.1.10
IBM MQ Appliance - update to 9.2.5
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.8
IBM Cognos Command Center - update to 10.2.4 Fix Pack 1 IF15
IBM App Connect Enterprise - addressed in versions 11.0.0.18, 12.0.5.0
Oracle Global Lifecycle Management NextGen OUI Framework - update to 13.9.4.2.10
rh-sso7-keycloak (Red Hat package) - addressed in versions 15.0.8-1.redhat_00001.1.el7sso, 15.0.8-1.redhat_00001.1.el8sso, 18.0.3-1.redhat_00001.1.el7sso, 18.0.3-1.redhat_00001.1.el8sso
IBM Business Automation Workflow - addressed in versions 19.0.0.3, 22.0.1
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.11, 22.0.1.1
Stream Analytics - update to 19.1.0.0.8
Oracle Blockchain Platform - update to 21.1.3
Big Data Spatial and Graph - update to 23.1
Splunk AppDynamics Database Agent - update to 26.1.0
Cloud Foundry UAA - update to 75.17.0
Bosh Release for the UAA - update to 75.17.0
Autodesk Infraworks - addressed in versions 2020.2 Hotfix 7, 2021.2 Hotfix 7, 2022.1.5 Hotfix 5, 2023.0.1 Hotfix 1
xsom - update to 0-19.20110809svn
Voice Gateway - addressed in versions 1.0.8.2, 1.0.8.6
bea-stax-api - update to 1.2.0-16
glassfish-fastinfoset - update to 1.2.13-9
xml-commons-resolver - update to 1.2-26
IBM MQ - addressed in versions 1.3.4 EUS, 1.8.2 CD
xml-commons-apis - update to 1.4.01-25
rh-sso7 (Red Hat package) - update to 1-5.el9sso
xmlstreambuffer - update to 1.5.4-8
Netcool Operations Insight - update to 1.6.9
stax-ex - update to 1.7.7-8
velocity - update to 1.7-24
slf4j-jdk14 - update to 1.7.25-4
slf4j - update to 1.7.25-4
Red Hat Integration Camel-K - update to 1.8
IBM Disconnected Log Collector - update to 1.8.3
Cloud Pak for Security (CP4S) - update to 1.10.14.0
watsonx.data - update to 2.0.3
AMQ Streams - addressed in versions 2.2.0, 2.4.0
QuMagie Mobile - update to 2.2.0.0126
glassfish-jaxb-txw2 - update to 2.2.11-12
glassfish-jaxb-runtime - update to 2.2.11-12
glassfish-jaxb-core - update to 2.2.11-12
glassfish-jaxb-api - update to 2.2.12-8
apache-commons-lang - update to 2.6-21
xalan-j2 - update to 2.7.1-38
jackson-module-jaxb-annotations - update to 2.7.6-4
jackson-databind - update to 2.9.8-10
jackson-databind-javadoc - update to 2.9.8-10
xerces-j2 - update to 2.11.0-34
jackson-databind (Debian package) - update to 2.12.1-1+deb11u1
jackson-bom - update to 2.13.0-150200.3.3.1
jackson-dataformats-binary-javadoc - update to 2.13.0-150200.3.3.3
jackson-dataformats-binary - update to 2.13.0-150200.3.3.3
jackson-dataformat-smile - update to 2.13.0-150200.3.3.3
jackson-dataformat-cbor - update to 2.13.0-150200.3.3.3
jackson-annotations - update to 2.13.0-150200.3.6.1
jackson-core-javadoc - update to 2.13.0-150200.3.6.1
jackson-core - update to 2.13.0-150200.3.6.1
jackson-annotations-javadoc - update to 2.13.0-150200.3.6.1
jackson-databind-javadoc - update to 2.13.0-150200.3.9.1
jackson-databind - update to 2.13.0-150200.3.9.1
jackson-parent - update to 2.14-1
jackson-annotations (Red Hat package) - update to 2.14.1-1.el9
jackson-modules-base (Red Hat package) - update to 2.14.1-2.el9
jackson-core (Red Hat package) - update to 2.14.1-2.el9
jackson-databind (Red Hat package) - update to 2.14.1-2.el9
jackson-jaxrs-providers (Red Hat package) - update to 2.14.1-2.el9
jackson-annotations - update to 2.14.2-1
jackson-bom - update to 2.14.2-1
jackson-core - update to 2.14.2-1
jackson-databind - update to 2.14.2-1
jackson-jaxrs-json-provider - update to 2.14.2-1
jackson-jaxrs-providers - update to 2.14.2-1
Financial Transaction Manager for ACH Services and Check Services - update to 3.0.5.4 iFix 28
resteasy - update to 3.0.26-7
jakarta-commons-httpclient - update to 3.1-28
apache-commons-collections - update to 3.2.2-10
apache-commons-net - update to 3.6-3
javassist-javadoc - update to 3.18.1-8
javassist - update to 3.18.1-8
IBM Tivoli Network Manager (ITNM) - update to 4.2.0.16
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.2
DB2 Warehouse on Cloud Pak for Data - update to 4.8.5
DB2 on Cloud Pak for Data - update to 4.8.5
idm-jss-javadoc - update to 4.11.0-1
idm-jss - update to 4.11.0-1
idm-ldapjdk-javadoc - update to 4.24.0-1
idm-ldapjdk - update to 4.24.0-1
rh-sso7-javapackages-tools (Red Hat package) - update to 6.0.0-7.el9sso
IBM Sterling B2B Integrator - addressed in versions 6.0.3.7, 6.1.0.6, 6.1.1.2, 6.1.2.1
IBM Engineering Lifecycle Optimization - Publishing - addressed in versions 7.0.1.23, 7.0.2.25
Jazz Reporting Service - update to 7.0.2 iFix022
Engineering Lifecycle Management - Jazz Foundation - addressed in versions 7.0.3 iFix020, 7.1.0 iFix006
IBM Maximo Asset Management - addressed in versions 7.6.1.2.32, 7.6.1.3.7
idm-tomcatjss - update to 7.8.0-1
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
Storage Virtualize - addressed in versions 8.6.3.0, 8.7.0.0
Operational Decision Manager - addressed in versions 8.10.5.2 Interim fix 1, 8.11.0.1 Interim fix 30, 8.11.1 Interim fix 24, 8.12.0.1 Interim fix 5
pki-servlet-engine - update to 9.0.62-1
IBM Supplied MQ Advanced Queue Manager Container images - addressed in versions 9.2.0.5-r2-eus, 9.2.5.0-r3
IBM Security Verify Governance - update to 10.0.1.0.4
python3-idm-pki - update to 10.15.0-1
idm-pki-tools - update to 10.15.0-1
idm-pki-kra - update to 10.15.0-1
idm-pki-symkey - update to 10.15.0-1
idm-pki-acme - update to 10.15.0-1
idm-pki-base - update to 10.15.0-1
idm-pki-base-java - update to 10.15.0-1
idm-pki-server - update to 10.15.0-1
idm-pki-ca - update to 10.15.0-1
Vue PACS - update to 12.2.8.410
Dell Data Protection Central - update to 19.9
EMC Data Protection Advisor - update to 19.10 B46
NetWorker - update to 19.10.0.0
Robotic Process Automation for Cloud Pak - update to 21.0.7
Oracle Spatial Studio - update to 22.1.0
Oracle Graph Server and Client - update to 22.2.0
fasterxml-oss-parent - update to 49-1
relaxngDatatype - update to 2011.1-7

• https://github.com/FasterXML/jackson-databind/issues/2816
• https://github.com/advisories/GHSA-57j2-w4cx-62h2

• Denial of service in jackson-databind
• Denial of service in Cloud Foundry uaa-release
• Denial of service in Cloud Foundry uaa
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Console
• Multiple vulnerabilities in Red Hat Data Grid
• Multiple vulnerabilities in IBM Cognos Command Center
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform
• Multiple vulnerabilities in Red Hat AMQ Broker
• Multiple vulnerabilities in Autodesk InfraWorks
• Multiple vulnerabilities in Eclipse Vert.x
• Multiple vulnerabilities in IBM Security Guardium
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Out-of-bounds write in IBM UrbanCode Deploy
• Multiple vulnerabilities in IBM i Modernization Engine for Lifecycle Integration
• Denial of service in IBM MQ Appliance
• Denial of service in IBM Business Automation Workflow and IBM Business Process Manager (BPM)
• Red Hat Quarkus update for jackson-databind
• Multiple vulnerabilities in Big Data Spatial and Graph
• Out-of-bounds write in Oracle Graph Server and Client
• Out-of-bounds write in Oracle Spatial Studio
• Multiple vulnerabilities in Oracle Commerce Platform
• Multiple vulnerabilities in Oracle Communications Billing and Revenue Management
• Out-of-bounds write in Oracle SD-WAN Edge
• Out-of-bounds write in Oracle Communications Cloud Native Core Service Communication Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Slice Selection Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in Primavera Gateway
• Out-of-bounds write in Primavera P6 Enterprise Project Portfolio Management
• Multiple vulnerabilities in Primavera Unifier
• Multiple vulnerabilities in Oracle Financial Services Enterprise Case Management
• Multiple vulnerabilities in Oracle Financial Services Behavior Detection Platform
• Multiple vulnerabilities in Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition
• Multiple vulnerabilities in Oracle Financial Services Analytical Applications Infrastructure
• Multiple vulnerabilities in Oracle Financial Services Crime and Compliance Management Studio
• Multiple vulnerabilities in Oracle Global Lifecycle Management NextGen OUI Framework
• Multiple vulnerabilities in Oracle Coherence
• Multiple vulnerabilities in Oracle WebLogic Server
• Out-of-bounds write in Oracle Health Sciences Empirica Signal
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in Oracle Retail Sales Audit
• Out-of-bounds write in Oracle Utilities Framework
• Denial of service in IBM Integration Bus and IBM App Connect Enterprise
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• IBM Process Mining update for Eclipse Jetty
• Multiple vulnerabilities in Red Hat Integration Camel-K
• Multiple vulnerabilities in Red Hat Single Sign-On 7.5
• Red Hat Single Sign-On 7.5 on RHEL 8 update for keycloak
• Red Hat Single Sign-On 7.5 on RHEL 7 update for keycloak
• Multiple vulnerabilities in Red Hat Process Automation Manager
• Multiple vulnerabilities in Red Hat AMQ Streams
• Multiple vulnerabilities in z/Transaction Processing Facility
• Multiple vulnerabilities in Oracle Database Server
• Multiple vulnerabilities in Oracle Communications Pricing Design Center
• Multiple vulnerabilities in Oracle Communications Instant Messaging Server
• Multiple vulnerabilities in Oracle Communications Services Gatekeeper
• Out-of-bounds write in Oracle Communications Evolved Communications Application Server
• Multiple vulnerabilities in Oracle Communications Policy Management
• Out-of-bounds write in Enterprise Manager for Virtualization
• Multiple vulnerabilities in Oracle Banking Platform
• Multiple vulnerabilities in Oracle Banking Party Management
• Out-of-bounds write in Oracle Banking Loans Servicing
• Multiple vulnerabilities in Oracle Banking Enterprise Default Management
• Out-of-bounds write in Oracle Healthcare Translational Research
• Multiple vulnerabilities in Documaker Enterprise Edition
• Multiple vulnerabilities in Solaris Cluster
• Multiple vulnerabilities in Oracle Autovue for Agile Product Lifecycle Management
• Multiple vulnerabilities in Oracle AutoVue
• Multiple vulnerabilities in Oracle Agile PLM Framework
• Multiple vulnerabilities in Siebel UI Framework
• Out-of-bounds write in Oracle Retail Service Backbone
• Multiple vulnerabilities in Oracle Retail Merchandising System
• Multiple vulnerabilities in JD Edwards EnterpriseOne Orchestrator
• Multiple vulnerabilities in JD Edwards EnterpriseOne Tools
• Multiple vulnerabilities in Oracle WebCenter Portal
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in Splunk Enterprise
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 8
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 7
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Multiple vulnerabilities in Red Hat OpenShift Logging 5.4
• Debian update for jackson-databind
• IBM Log Analysis update for FasterXML jackson-databind
• Multiple vulnerabilities in IBM CICS Transaction Gateway
• Multiple vulnerabilities in IBM Data Risk Manager
• Multiple vulnerabilities in Openshift Logging 5.3
• Multiple vulnerabilities in OpenShift Logging 5.5
• Multiple vulnerabilities in IBM Tivoli Network Manager
• Out-of-bounds write in IBM Common Licensing
• Out-of-bounds write in IBM Sterling B2B Integrator
• Multiple vulnerabilities in Oracle Commerce Guided Search
• Multiple vulnerabilities in Stream Analytics
• Out-of-bounds write in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in OpenShift Logging 5.6
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in IBM Voice Gateway
• Out-of-bounds write in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• SUSE update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core
• Multiple vulnerabilities in API Gateway and API Manager
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in Oracle Blockchain Platform
• Multiple vulnerabilities in IBM Maximo Asset Management
• Red Hat Enterprise Linux 9 update for jackson
• Multiple vulnerabilities in Dell RecoverPoint Classic
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Red Hat AMQ Streams 2.4
• IBM QRadar SIEM update for third-party components
• Multiple vulnerabilities in Netcool Operations Insight
• Out-of-bounds write in Oracle Access Manager
• Multiple vulnerabilities in Dell Data Protection Central
• Multiple vulnerabilities in IBM Application Performance Management products
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in Enterprise Manager Base Platform
• Multiple vulnerabilities in IBM Jazz Reporting Service
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Jira Service Management Data Center and Server update for jackson-databind
• Multiple vulnerabilities in IBM Engineering Lifecycle Optimization - Publishing
• Multiple vulnerabilities in Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in third-party components in Jira Software Data Center and Server
• Multiple vulnerabilities in Dell Networker
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS/DWA
• Multiple vulnerabilities in QNAP QuMagie Mobile for Android
• openEuler update for jackson-databind
• openEuler 20.03 LTS SP4 update for jackson-databind
• Multiple vulnerabilities in IBM Integration Designer
• Multiple vulnerabilities in IBM Operational Decision Manager
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data
• Red Hat Enterprise Linux 8 update for the pki-core:10.6 and pki-deps:10.6 modules
• Multiple vulnerabilities in Philips Vue PACS
• Multiple vulnerabilities in IBM Storage Virtualize
• Multiple vulnerabilities in Data Protection Advisor
• IBM watsonx.data update for FasterXML jackson-databind
• Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
• Anolis OS update for pki-deps:10.6 and pki-core:10.6 modules
• SecurID Authentication Manager update for third-party components
• SecurID Authentication Manager update for third-party components
• Multiple vulnerabilities in Cloudera Observability on Premises with IBM
• Crowd Data Center update for jackson-databind
• Multiple vulnerabilities in IBM B2B Advanced Communications
• Multiple vulnerabilities in IBM Datacap
• Multiple vulnerabilities in IBM Engineering Lifecycle Management - Jazz Foundation
• Multiple vulnerabilities in IBM Financial Transaction Manager for ACH Services and Check Services for Multi-Platform
• Splunk AppDynamics Database Agent update for third-party components