CVE-2019-20330: Debian Linux

Critical severity, CVSS 9.8. EPSS: 8.6% chance of exploitation in the next 30 days.

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.

Affected products

  • Debian Debian Linux: version 8.0 only
  • Fasterxml Jackson-Databind: from 2.0.0, before 2.7.9.7 (fixed in 2.7.9.7); from 2.8.0, before 2.8.11.5 (fixed in 2.8.11.5); from 2.9.0, before 2.9.10.2 (fixed in 2.9.10.2)
  • Netapp Active Iq Unified Manager: from 7.3; from 9.5
  • Netapp Oncommand API Services: affected versions not specified
  • Netapp Service Level Manager: affected versions not specified
  • Netapp Snapcenter: affected versions not specified
  • Netapp Steelstore Cloud Integrated Storage: affected versions not specified
  • Oracle Banking Platform: from 2.4.0, up to and including 2.9.0
  • Oracle Communications Billing And Revenue Management: version 7.5.0.23.0 only; version 12.0.0.3.0 only
  • Oracle Communications Cloud Native Core Network Slice Selection Function: version 1.2.1 only
  • Oracle Communications Contacts Server: version 8.0.0.4.0 only
  • Oracle Communications Evolved Communications Application Server: version 7.1 only
  • Oracle Communications Instant Messaging Server: version 10.0.1.4.0 only
  • Oracle Communications Network Charging And Control: from 12.0.0, up to and including 12.0.3; version 6.0.1 only
  • Oracle Customer Management And Segmentation Foundation: version 18.0 only
  • Oracle Enterprise Manager Base Platform: version 13.3.0.0 only; version 13.4.0.0 only
  • Oracle Global Lifecycle Management Opatch: before 11.2.0.3.23 (fixed in 11.2.0.3.23); from 12.2.0.1.0, before 12.2.0.1.19 (fixed in 12.2.0.1.19); from 13.9.4.0.0, before 13.9.4.2.1 (fixed in 13.9.4.2.1)
  • Oracle Goldengate Application Adapters: version 19.1.0.0.0 only
  • Oracle Goldengate Stream Analytics: before 19.1.0.0.1 (fixed in 19.1.0.0.1)
  • Oracle Jd Edwards Enterpriseone Orchestrator: before 9.2.4.2 (fixed in 9.2.4.2)
  • Oracle Jd Edwards Enterpriseone Tools: before 9.2.4.2 (fixed in 9.2.4.2)
  • Oracle Primavera Unifier: from 17.7, up to and including 17.12; version 16.1 only; version 16.2 only; version 18.8 only; version 19.12 only
  • Oracle Retail Merchandising System: version 15.0.3 only; version 16.0.2 only; version 16.0.3 only
  • Oracle Retail Sales Audit: version 14.1 only
  • Oracle Retail Xstore Point Of Service: version 15.0 only; version 16.0 only; version 17.0 only; version 18.0 only; version 19.0 only
  • and 5 more

Published 2020-01-03. Last modified 2026-10-08.