CVE-2020-25649
jackson-databind - security update
7.5
HIGH
CVSS 3.1
EPSS 17.6%
Description
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
How to fix CVE-2020-25649
To remediate CVE-2020-25649, upgrade the affected package to a fixed version below.
- Debian/jackson-databind—upgrade to 2.11.1-1 or later
- —upgrade to 2.8.6-1+deb9u8 or later
- —upgrade to 2.6.7.4 or later
Is CVE-2020-25649 being exploited?
Moderate — EPSS is 17.6%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (3)
- from 0, < 2.11.1-1
- from 0, < 2.8.6-1+deb9u8
- >= 2.6.0, < 2.6.7.4
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |