VDB
CVE-2021-20190
CVE-2021-20190
PUBLISHED
CVSS 8.100000381469727 HIGH
A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
EPSS 7.48% · 94.1th percentile
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
7.48%
94.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | nifi | 1.7.0 |
| Bitnami | nifi | 1.7.0 |
Timeline
- Jan 19, 2021 CVE Published
- Apr 14, 2021 EPSS Score
- Apr 27, 2021 EPSS Score
- Jul 21, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Dec 28, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 2, 2022 EPSS Score
- Jul 4, 2022 EPSS Score
- Nov 7, 2022 EPSS Score
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-20190 url
- https://www.oracle.com//security-alerts/cpujul2021.html url
- Multiples vulnérabilités dans les produits Splunk advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1916633 url
- https://github.com/FasterXML/jackson-databind/issues/2854 url
- https://lists.apache.org/thread.html/r380e9257bacb8551ee6fcf2c59890ae9477b2c78e553fa9ea08e9d9a%40%3Ccommits.nifi.apache.org%3E url
- https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html url
- https://security.netapp.com/advisory/ntap-20210219-0008/ url