CVE-2020-8840: Debian Linux

Critical severity, CVSS 9.8. EPSS: 26.6% chance of exploitation in the next 30 days.

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

Affected products

• Debian Debian Linux: version 8.0 only
• Fasterxml Jackson-Databind: from 2.0.0, before 2.7.9.7 (fixed in 2.7.9.7); from 2.8.0, before 2.8.11.5 (fixed in 2.8.11.5); from 2.9.0, before 2.9.10.3 (fixed in 2.9.10.3)
• Huawei Oceanstor 9000 Firmware: version v300r006c20 only; version v300r006c20spc100 only; version v300r006c20spc200 only; version v300r006c20spc300 only
• Netapp Oncommand API Services: affected versions not specified
• Netapp Oncommand Workflow Automation: affected versions not specified
• Netapp Service Level Manager: affected versions not specified
• Netapp Steelstore Cloud Integrated Storage: affected versions not specified
• Oracle Global Lifecycle Management Opatch: before 11.2.0.3.23 (fixed in 11.2.0.3.23); from 12.2.0.1.0, before 12.2.0.1.19 (fixed in 12.2.0.1.19); from 13.9.4.0.0, before 13.9.4.2.1 (fixed in 13.9.4.2.1)

Published 2020-02-10. Last modified 2026-10-08.