High severity8.8NVD Advisory· Published Mar 31, 2020· Updated Apr 29, 2026

CVE-2020-11113

Description

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
com.fasterxml.jackson.core:jackson-databindMaven	>= 2.9.0, < 2.9.10.4	2.9.10.4

Affected products

Fasterxml/Jackson Databind
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
Range: >=2.0.0,<2.9.10.4
NetApp/Steelstore Cloud Integrated Storage
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
Oracle Corporation/Agile Plm
cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
Oracle Corporation/Autovue For Agile Product Lifecycle Management
cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:*
Oracle Corporation/Banking Digital Experience6 versions
cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_digital_experience:18.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*
Oracle Corporation/Banking Platform
cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*
Range: >=2.4.0,<=2.9.0
Oracle Corporation/Communications Calendar Server
cpe:2.3:a:oracle:communications_calendar_server:8.0.0.4.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Contacts Server
cpe:2.3:a:oracle:communications_contacts_server:8.0.0.5.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Diameter Signaling Router
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*
Range: >=8.0.0,<=8.2.2
Oracle Corporation/Communications Element Manager
cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*
Range: >=8.2.0,<=8.2.2
Oracle Corporation/Communications Evolved Communications Application Server
cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*
Oracle Corporation/Communications Instant Messaging Server
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.4.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Network Charging And Control2 versions
cpe:2.3:a:oracle:communications_network_charging_and_control:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:communications_network_charging_and_control:*:*:*:*:*:*:*:*range: >=12.0.0,<=12.0.3
- cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1:*:*:*:*:*:*:*
Oracle Corporation/Communications Session Report Manager
cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*
Range: >=8.2.0,<=8.2.2
Oracle Corporation/Communications Session Route Manager
cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*
Range: >=8.2.0,<=8.2.2
Oracle Corporation/Enterprise Manager Base Platform2 versions
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*
Oracle Corporation/Financial Services Analytical Applications Infrastructure
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*
Range: >=8.0.6,<=8.1.0
Oracle Corporation/Financial Services Institutional Performance Analytics3 versions
cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.6:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.1.0:*:*:*:*:*:*:*
Oracle Corporation/Financial Services Price Creation And Discovery2 versions
cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.6:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.7:*:*:*:*:*:*:*
Oracle Corporation/Financial Services Retail Customer Analytics
cpe:2.3:a:oracle:financial_services_retail_customer_analytics:8.0.6:*:*:*:*:*:*:*
Oracle Corporation/Global Lifecycle Management Opatch
cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*
Range: <12.2.0.1.20
Oracle Corporation/Insurance Policy Administration J2ee2 versions
cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.0.2.25:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.0.2.25:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.1.0.15:*:*:*:*:*:*:*
Oracle Corporation/Jd Edwards Enterpriseone Orchestrator
cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:*
Range: <9.2.4.2
Oracle Corporation/Jd Edwards Enterpriseone Tools
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Range: <9.2.4.2
Oracle Corporation/Primavera Unifier5 versions
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*range: >=17.7,<=17.12
- cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*
Oracle Corporation/Retail Merchandising System
cpe:2.3:a:oracle:retail_merchandising_system:15.0:*:*:*:*:*:*:*
Oracle Corporation/Retail Sales Audit
cpe:2.3:a:oracle:retail_sales_audit:14.1:*:*:*:*:*:*:*
Oracle Corporation/Retail Service Backbone3 versions
cpe:2.3:a:oracle:retail_service_backbone:14.1:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:retail_service_backbone:14.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_service_backbone:15.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_service_backbone:16.0:*:*:*:*:*:*:*
Oracle Corporation/Retail Xstore Point Of Service5 versions
cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0:*:*:*:*:*:*:*
Oracle Corporation/Webcenter Portal2 versions
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
Oracle Corporation/Weblogic Server2 versions
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
Debian/Debian Linux
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Patches

1d919062ec35

[maven-release-plugin] prepare release jackson-databind-2.9.10.4

https://github.com/FasterXML/jackson-databindTatu SalorantaApr 11, 2020via osv

commit

1 file changed · +2 −2

pom.xml+2 −2 modified

@@ -10,7 +10,7 @@
 
   <groupId>com.fasterxml.jackson.core</groupId>
   <artifactId>jackson-databind</artifactId>
-  <version>2.9.10.4-SNAPSHOT</version>
+  <version>2.9.10.4</version>
   <name>jackson-databind</name>
   <packaging>bundle</packaging>
   <description>General data-binding functionality for Jackson: works on core streaming API</description>
@@ -21,7 +21,7 @@
     <connection>scm:git:git@github.com:FasterXML/jackson-databind.git</connection>
     <developerConnection>scm:git:git@github.com:FasterXML/jackson-databind.git</developerConnection>
     <url>http://github.com/FasterXML/jackson-databind</url>
-    <tag>HEAD</tag>
+    <tag>jackson-databind-2.9.10.4</tag>
   </scm>
 
   <properties>

08fbfacf89a4

https://github.com/FasterXML/jackson-databindvia ghsa

commit

e2ba12d5d607

https://github.com/FasterXML/jackson-databindvia ghsa

commit

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

github.com/FasterXML/jackson-databind/issues/2670nvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujan2021.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujul2020.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuoct2020.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuoct2021.htmlnvdPatchThird Party AdvisoryWEB
github.com/advisories/GHSA-9vvp-fxw6-jcxrghsaADVISORY
lists.debian.org/debian-lts-announce/2020/04/msg00012.htmlnvdMailing ListThird Party AdvisoryWEB
medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062nvdThird Party Advisory
nvd.nist.gov/vuln/detail/CVE-2020-11113ghsaADVISORY
security.netapp.com/advisory/ntap-20200403-0002/nvdThird Party Advisory
github.com/FasterXML/jackson-databind/commit/08fbfacf89a4a4c026a6227a1b470ab7a13e2e88ghsaWEB
github.com/FasterXML/jackson-databind/commit/e2ba12d5d60715d95105e3e790fc234cfb59893dghsaWEB
medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062ghsaWEB
security.netapp.com/advisory/ntap-20200403-0002ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.049
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000