Vulnerability Name:

CVE-2020-36518 (CCN-222319)

Assigned:2020-08-12
Published:2020-08-12
Updated:2022-11-29
Summary:FasterXML jackson-databind is vulnerable to a denial of service, caused by a Java StackOverflow exception. By using a large depth of nested objects, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS v3 Severity:7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.9 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:U/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.9 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:U/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2020-36518

Source: XF
Type: UNKNOWN
fasterxml-cve202036518-dos(222319)

Source: CCN
Type: GitHub Advisory Database
Deeply nested json in jackson-databind

Source: CCN
Type: jackson-databind GIT Repository
Optimize UntypedObjectDeserializer wrt recursion #2816

Source: cve@mitre.org
Type: Issue Tracking, Third Party Advisory
cve@mitre.org

Source: cve@mitre.org
Type: Exploit, Mailing List, Third Party Advisory
cve@mitre.org

Source: cve@mitre.org
Type: Mailing List, Third Party Advisory
cve@mitre.org

Source: cve@mitre.org
Type: Third Party Advisory
cve@mitre.org

Source: cve@mitre.org
Type: Third Party Advisory
cve@mitre.org

Source: CCN
Type: IBM Security Bulletin 6555376 (Cognos Command Center)
IBM Cognos Command Center is affected by multiple vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6573013 (Watson Speech Services Cartridge for Cloud Pak for Data)
A Vulnerability with jackson-databind before 2.13.0 affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data

Source: CCN
Type: IBM Security Bulletin 6579513 (Informix Dynamic Server)
IBM Informix Dynamic Server is affected to denial of service due to FasterXML jackson-databind (CVE-2020-36518)

Source: CCN
Type: IBM Security Bulletin 6589939 (MQ Operator)
IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from gzip, jackson-databind, libssh, gnutls, nettle and zlib

Source: CCN
Type: IBM Security Bulletin 6598053 (Security Guardium)
IBM Security Guardium is affected by multiple vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6598765 (Cloud Transformation Advisor)
IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6600063 (UrbanCode Deploy)
UrbanCode Deploy is vulnerable to denial of service due to Jackson-databind (CVE-2020-36518)

Source: CCN
Type: IBM Security Bulletin 6601131 (App Connect Enterprise Certified Container)
IBM App Connect Enterprise Certified Container IntegrationServer operands that process JSON data may be vulnerable to denial of service due to CVE-2020-36518

Source: CCN
Type: IBM Security Bulletin 6601521 (Tivoli Netcool/Impact)
A security vulnerability has been identified in jackson-databind shipped with IBM Tivoli Netcool Impact (CVE-2020-36518, WS-2021-0616)

Source: CCN
Type: IBM Security Bulletin 6602625 (i Modernization Engine for Lifecycle Integration)
IBM i Modernization Engine for Lifecycle Integration is vulnerable to multiple vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6603415 (MQ Appliance)
IBM MQ Appliance is affected by FasterXML jackson-databind vulnerabilities (CVE-2020-36518)

Source: CCN
Type: IBM Security Bulletin 6603665 (Business Automation Workflow)
Denial of Service vulnerability affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-2020-35618

Source: CCN
Type: IBM Security Bulletin 6607101 (App Connect Enterprise)
IBM Integration Bus and IBM App Connect Enterprise are vulnerable to a denial of service due to jackson-databind (CVE-2020-36518)

Source: CCN
Type: IBM Security Bulletin 6611967 (Cloud Pak for Automation)
Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for July 2022

Source: CCN
Type: IBM Security Bulletin 6613321 (Process Mining)
Vulnerability in FasterXML jackson-databind affects IBM Process Mining . CVE-2020-36518

Source: CCN
Type: IBM Security Bulletin 6615285 (Cognos Analytics)
IBM Cognos Analytics has addressed multiple vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6825139 (QRadar User Behavior Analytics)
Multiple vulnerabilities in Zookeeper affecting IBM QRadar User Behavior Analytics (CVE-2022-2191, CVE-2022-2047, CVE-2022-2048, CVE-2022-24823, CVE-2020-36518)

Source: CCN
Type: IBM Security Bulletin 6828455 (z/Transaction Processing Facility)
z/Transaction Processing Facility is affected by multiple vulnerabilities in the jackson-databind, jackson-dataformat-xml, jackson-core, slf4j-ext, and cxf-core packages

Source: CCN
Type: IBM Security Bulletin 6832944 (Business Automation Manager Open Editions)
Multiple security vulnerabilities are addressed with IBM Business Automation Manager Open Editions 8.0.1

Source: CCN
Type: Oracle CPUApr2022
Oracle Critical Patch Update Advisory - April 2022

Source: cve@mitre.org
Type: Third Party Advisory
cve@mitre.org

Source: CCN
Type: Oracle CPUJul2022
Oracle Critical Patch Update Advisory - July 2022

Source: cve@mitre.org
Type: Third Party Advisory
cve@mitre.org

Vulnerable Configuration:Configuration CCN 1:
  • cpe:/a:fasterxml:jackson-databind:2.13.0:-:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:tivoli_netcool/impact:7.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:utilities_framework:4.3.0.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_process_manager:8.6.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:primavera_unifier:17.12:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:app_connect:11.0.0.0:*:*:*:enterprise:*:*:*
  • OR cpe:/a:ibm:integration_bus:10.0.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cognos_command_center:10.2.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:19.0.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:utilities_framework:4.3.0.6.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:commerce_platform:11.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_transformation_advisor:2.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_automation:19.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:19.0.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_process_manager:8.5.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_guardium:11.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_guardium:11.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_automation:20.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_automation:20.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:informix_dynamic_server:14.10:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_guardium:11.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:20.0.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:20.0.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_automation:20.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_guardium:11.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_automation:21.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_automation:21.0.2:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:cognos_analytics:11.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cognos_analytics:11.1.7:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_guardium:11.4:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cognos_analytics:11.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:informix_dynamic_server:12.10:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_automation:19.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:21.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_automation:19.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:app_connect_enterprise_certified_container:4.2:*:*:*:*:*:*:*

  • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:7533
    P
    jackson-annotations-2.13.0-150200.3.6.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:7534
    P
    jackson-databind-2.13.4.2-150200.3.12.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:3601
    P
    libgssglue1-0.4-3.76 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3688
    P
    libtiff5-32bit-4.0.9-44.30.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:119094
    P
    Security update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core (Important)
    2022-05-16
    oval:org.opensuse.security:def:94024
    P
    (Important)
    2022-05-16
    oval:org.opensuse.security:def:480
    P
    Security update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core (Important)
    2022-05-16
    oval:org.opensuse.security:def:95318
    P
    Security update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core (Important)
    2022-05-16
    oval:org.opensuse.security:def:119202
    P
    Security update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core (Important)
    2022-05-16
    oval:org.opensuse.security:def:94236
    P
    (Important)
    2022-05-16
    oval:org.opensuse.security:def:118705
    P
    Security update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core (Important)
    2022-05-16
    oval:org.opensuse.security:def:119392
    P
    Security update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core (Important)
    2022-05-16
    oval:org.opensuse.security:def:94445
    P
    (Important)
    2022-05-16
    oval:org.opensuse.security:def:889
    P
    Security update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core (Important)
    2022-05-16
    oval:org.opensuse.security:def:118895
    P
    Security update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core (Important)
    2022-05-16
    oval:org.opensuse.security:def:93810
    P
    (Important)
    2022-05-16
    oval:org.opensuse.security:def:119577
    P
    Security update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core (Important)
    2022-05-16
    oval:org.opensuse.security:def:95231
    P
    Security update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core (Important)
    2022-05-16
    oval:org.opensuse.security:def:1167
    P
    Security update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core (Important)
    2022-05-16
    oval:org.opensuse.security:def:101848
    P
    Security update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core (Important) (in QA)
    2022-04-19
    oval:org.opensuse.security:def:101619
    P
    Security update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core (Important) (in QA)
    2022-04-13
    BACK
    fasterxml jackson-databind 2.13.0 -
    ibm tivoli netcool/impact 7.1.0
    oracle weblogic server 12.2.1.3.0
    oracle utilities framework 4.3.0.3.0
    ibm business process manager 8.6.0.0
    ibm business automation workflow 18.0.0.0
    oracle primavera unifier 17.12
    oracle primavera unifier 18.8
    ibm app connect 11.0.0.0
    ibm integration bus 10.0.0.0
    ibm business automation workflow 18.0.0.2
    ibm cognos command center 10.2.4.1
    ibm business automation workflow 19.0.0.1
    oracle utilities framework 4.3.0.6.0
    oracle commerce platform 11.3.1
    ibm cloud transformation advisor 2.0.1
    ibm cloud pak for automation 19.0.3
    ibm business automation workflow 19.0.0.3
    ibm business process manager 8.5.0.0
    ibm security guardium 11.0
    ibm security guardium 11.1
    ibm cloud pak for automation 20.0.1
    ibm cloud pak for automation 20.0.2
    ibm informix dynamic server 14.10
    ibm security guardium 11.2
    ibm business automation workflow 20.0.0.1
    ibm business automation workflow 20.0.0.2
    ibm cloud pak for automation 20.0.3
    ibm security guardium 11.3
    ibm cloud pak for automation 21.0.1
    ibm cloud pak for automation 21.0.2 -
    ibm cognos analytics 11.2.0
    ibm cognos analytics 11.1.7
    ibm security guardium 11.4
    ibm cognos analytics 11.2.1
    ibm informix dynamic server 12.10
    ibm cloud pak for automation 19.0.1
    ibm business automation workflow 21.0.3
    ibm cloud pak for automation 19.0.2
    ibm app connect enterprise certified container 4.2