CVE-2020-10968: Debian Linux
High severity, CVSS 8.8. EPSS: 3.6% chance of exploitation in the next 30 days.
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).
Affected products
- Debian Debian Linux: version 8.0 only
- Fasterxml Jackson-Databind: from 2.9.0, before 2.9.10.4 (fixed in 2.9.10.4)
- Netapp Steelstore Cloud Integrated Storage: affected versions not specified
- Oracle Agile Product Lifecycle Management: version 9.3.6 only
- Oracle Autovue For Agile Product Lifecycle Management: version 21.0.2 only
- Oracle Banking Digital Experience: version 18.1 only; version 18.2 only; version 18.3 only; version 19.1 only; version 19.2 only; version 20.1 only
- Oracle Banking Platform: from 2.4.0, up to and including 2.9.0
- Oracle Communications Calendar Server: version 8.0.0.4.0 only
- Oracle Communications Contacts Server: version 8.0.0.4.0 only; version 8.0.0.5.0 only
- Oracle Communications Diameter Signaling Router: from 8.0.0, up to and including 8.2.2
- Oracle Communications Element Manager: from 8.2.0, up to and including 8.2.2
- Oracle Communications Evolved Communications Application Server: version 7.1 only
- Oracle Communications Instant Messaging Server: version 10.0.1.4.0 only
- Oracle Communications Network Charging And Control: from 12.0.0, up to and including 12.0.3; version 6.0.1 only
- Oracle Communications Session Report Manager: from 8.2.0, up to and including 8.2.2
- Oracle Communications Session Route Manager: from 8.2.0, up to and including 8.2.2
- Oracle Enterprise Manager Base Platform: version 13.3.0.0 only; version 13.4.0.0 only
- Oracle Financial Services Analytical Applications Infrastructure: from 8.0.6, up to and including 8.1.0
- Oracle Financial Services Institutional Performance Analytics: version 8.0.6 only; version 8.0.7 only; version 8.1.0 only
- Oracle Financial Services Price Creation And Discovery: version 8.0.6 only; version 8.0.7 only
- Oracle Financial Services Retail Customer Analytics: version 8.0.6 only
- Oracle Global Lifecycle Management Opatch: before 12.2.0.1.20 (fixed in 12.2.0.1.20)
- Oracle Insurance Policy Administration j2ee: version 11.0.2.25 only; version 11.1.0.15 only
- Oracle Jd Edwards Enterpriseone Orchestrator: before 9.2.4.2 (fixed in 9.2.4.2)
- Oracle Jd Edwards Enterpriseone Tools: before 9.2.4.2 (fixed in 9.2.4.2)
- and 6 more
Published 2020-03-26. Last modified 2026-08-25.