CVE-2020-11112

HighCVSS 8.8/10Last modified Aug 25, 2026

Description

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

VendorProductVersions
n/an/an/a
fasterxmljackson-databind< 2.9.10.4
debiandebian_linux8.0
netappsteelstore_cloud_integrated_storage*
oracleagile_plm9.3.6
oracleautovue_for_agile_product_lifecycle_management21.0.2
oraclebanking_digital_experience>= 18.1, <= 18.3; >= 19.1, <= 19.2; 20.1; >= 2.4.0, <= 2.9.0
oraclecommunications_calendar_server>= 8.0.0.4.0, <= 8.0.0.5.0
oraclecommunications_diameter_signaling_router>= 8.0.0, <= 8.2.2
oraclecommunications_element_manager>= 8.2.0, <= 8.2.2
oraclecommunications_evolved_communications_application_server7.1
oraclecommunications_instant_messaging_server10.0.1.4.0
oraclecommunications_network_charging_and_control6.0.1
oraclecommunications_network_charging_and_control>= 12.0.0, <= 12.0.3
oraclecommunications_session_route_manager>= 8.2.0, <= 8.2.2
oracleenterprise_manager_base_platform>= 13.3.0.0, <= 13.4.0.0
oraclefinancial_services_analytical_applications_infrastructure>= 8.0.6, <= 8.1.0
oraclefinancial_services_institutional_performance_analytics8.0.6; 8.0.7; 8.1.0
oraclefinancial_services_price_creation_and_discovery>= 8.0.6, <= 8.0.7
oraclefinancial_services_retail_customer_analytics8.0.6
oracleglobal_lifecycle_management_opatch<= 12.2.0.1.20
oracleinsurance_policy_administration_j2ee>= 11.0.2.25, < 11.1.0.15
oraclejd_edwards_enterpriseone_orchestrator<= 9.2.4.2
oracleprimavera_unifier16.1; 16.2; >= 17.7, <= 17.12; 18.8; 19.12
oracleretail_merchandising_system15.0
oracleretail_sales_audit14.1
oracleretail_service_backbone14.1; 15.0; 16.0
oracleretail_xstore_point_of_service>= 15.0, <= 19.0
oracleweblogic_server>= 12.2.1.3.0, <= 12.2.1.4.0

References

Timeline

Published
Mar 31, 2020
Last modified
Aug 25, 2026
NVD status
Analyzed

Related CVEs from 2020

CVE-2020-111138.8FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.opCVE-2020-111148.8u'Bluetooth devices does not properly restrict the L2CAP payload length allowing users in radio range to cause a buffer overflow via a craftCVE-2020-111157.5u'Buffer over read occurs while processing information element from beacon due to lack of check of data received from beacon' in Snapdragon CVE-2020-111169.8u'Possible out of bound write while processing association response received from host due to lack of check of IE length' in Snapdragon AutoCVE-2020-111179.8u'In the lbd service, an external user can issue a specially crafted debug command to overwrite arbitrary files with arbitrary content resulCVE-2020-111187.5u'Information exposure issues while processing IE header due to improper check of beacon IE frame' in Snapdragon Auto, Snapdragon Compute, SCVE-2020-111197.5Buffer over-read can happen when the buffer length received from response handlers is more than the size of the payload in Snapdragon Auto, CVE-2020-11128.5An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) IIS module improperly handlesCVE-2020-111207.8u'Calling thread may free the data buffer pointer that was passed to the callback and later when event loop executes the callback, data buffCVE-2020-111217.8u'Possible buffer overflow in WIFI hal process due to usage of memcpy without checking length of destination buffer' in Snapdragon Auto, SnaCVE-2020-111225.5u'Null Pointer exception while playing crafted mkv file as data stream get deleted on secondary invalid configuration' in Snapdragon Auto, SCVE-2020-111235.5u'information disclosure in gatekeeper trustzone implementation as the throttling mechanism to prevent brute force attempts at getting user`