CVE-2020-14061

jackson-databind: serialization in weblogic/oracle-aqjms

Published Jun 14, 2020 CVSS 3.1 · 8.1 High EPSS 4.5% KEV · Not listed
Description
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-2270-1 jackson-databind security update
EUVD EUVD EUVD-2020-0478 FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).
Github GHSA Github GHSA GHSA-c2q3-4qrh-fm48 Deserialization of untrusted data in Jackson Databind
Ubuntu USN Ubuntu USN USN-4813-1 Jackson Databind vulnerabilities
History
Type Values Removed Values Added
First Time appeared Oracle agile Product Lifecycle Management
CPEs cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*
Vendors & Products Oracle agile Plm
Oracle agile Product Lifecycle Management
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 27, 2025, 8:33 PM
Reserved
Jun 14, 2020, 12:00 AM
Status
Modified
Published
Jun 14, 2020, 8:15 PM
Modified
Aug 25, 2026, 4:28 PM
Severity
Important
Public date
May 19, 2020, 12:00 AM