Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2020-10650
8.1
HIGHCVSS v3
Published
December 26, 2022
Affected
1 project
Assigned by
MITRE
Severity scale
010
Description
A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.
FasterXML/jackson-databind
GitHubGeneral data-binding package for Jackson: works on streaming API (core) implementation(s)
GitHubGeneral data-binding package for Jackson: works on streaming API (core) implementation(s)= *, < 2.9.10.4, = 2.10.0NVD