Skip to content
Fencer Vulns
high 7.5

CVE-2020-25649 in the critical feed json

XML External Entity (XXE) Injection in Jackson Databind

published 2020-12-03 5 y ago modified 2026-10-08 31 d ago also GHSA-288c-cq4h-88gq , EUVD-2021-0525

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
17.7%
EPSS 17.7% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

Patch / fix

  • maven com.fasterxml.jackson.core:jackson-databind 2.6.7.4, 2.9.10.7, 2.10.5.1
  • fasterxml jackson-databind 2.6.7.4, 2.9.10.7, 2.10.5.1
  • apache iotdb 0.12.0
  • oracle blockchain_platform 21.1.2
  • oracle jd_edwards_enterpriseone_orchestrator 9.2.5.3
  • oracle jd_edwards_enterpriseone_tools 9.2.5.3
  • jackson-databind Debian 14, Debian 13, Debian 12 2.11.1-1

debian advisories DEBIAN-CVE-2020-25649

  • eap7-jasypt jboss enterprise application platform 7.3 1.9.3-1.redhat_00002.1.el8eap
  • eap7-fge-btf jboss enterprise application platform 7.3 1.2.0-1.redhat_00007.1.el8eap
  • eap7-wildfly jboss enterprise application platform 7.3 7.3.4-3.GA_redhat_00003.1.el8eap
  • eap7-undertow jboss enterprise application platform 7.3 2.0.32-1.SP1_redhat_00001.1.el8eap
  • eap7-hal-console jboss enterprise application platform 7.3 3.2.11-1.Final_redhat_00001.1.el8eap
  • eap7-jackson-core jboss enterprise application platform 7.3 2.10.4-1.redhat_00002.1.el8eap
  • eap7-fge-msg-simple jboss enterprise application platform 7.3 1.1.0-1.redhat_00007.1.el8eap
  • eap7-jboss-remoting jboss enterprise application platform 7.3 5.0.19-1.Final_redhat_00001.1.el8eap

red hat advisories RHSA-2020:5342RHSA-2020:5341RHSA-2020:5340RHSA-2021:0381RHSA-2020:4401RHSA-2020:4312

  • jackson-core SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +12 more 2.13.0-150200.3.6.1
  • jackson-bom openSUSE Leap 15.4, openSUSE Leap 15.3 2.13.0-150200.3.3.1
  • jackson-databind SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +12 more 2.13.0-150200.3.9.1
  • jackson-annotations SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +12 more 2.13.0-150200.3.6.1
  • jackson-dataformats-binary SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +11 more 2.13.0-150200.3.3.3
  • jackson-databind SLE Module for Development Tools 15 SP2 2.10.5.1-3.3.2

suse advisories SUSE-SU-2022:1678-1SUSE-SU-2021:0243-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-25649 updated cvss 7.5

jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)

  • Red Hat A-MQ Clients 2 jackson-databind
    affected: workaround, no fix available “There is currently no known mitigation for this flaw.”
  • Red Hat BPM Suite 6 jackson-databind
    affected: workaround, no fix planned “There is currently no known mitigation for this flaw.”
  • Red Hat build of Quarkus jackson-databind Red Hat Enterprise Linux 8 jackson-databind, jackson-databind-javadoc Red Hat Fuse 7 jackson-databind Red Hat Integration Camel K 1 jackson-databind
    affected: workaround, no fix available “There is currently no known mitigation for this flaw.”
  • Red Hat JBoss A-MQ 6 jackson-databind Red Hat JBoss BRMS 6 jackson-databind Red Hat JBoss Data Virtualization 6 jackson-databind Red Hat JBoss Enterprise Application Platform 6 jackson-databind Red Hat JBoss Fuse 6 jackson-databind
    affected: workaround, no fix planned “There is currently no known mitigation for this flaw.”
  • Red Hat OpenShift Application Runtimes jackson-databind Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5
    affected: workaround, no fix available “There is currently no known mitigation for this flaw.”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-metering-hive, openshift4/ose-metering-hadoop, openshift4/ose-metering-presto, openshift4/ose-logging-elasticsearch5
    affected: workaround, no fix available, no fix planned “There is currently no known mitigation for this flaw.”
  • Red Hat OpenStack Platform 10 (Newton) opendaylight Red Hat OpenStack Platform 13 (Queens) opendaylight
    affected: workaround, no fix planned “There is currently no known mitigation for this flaw.”
  • Red Hat Satellite 6 candlepin, candlepin-selinux
    affected: workaround, no fix available “There is currently no known mitigation for this flaw.”
show 17 more
  • Red Hat AMQ Streams 1.7.0
    fixed: vendor fix “There is currently no known mitigation for this flaw.” RHSA-2021:1260
  • Red Hat Data Grid 7.3.8
    fixed: vendor fix “There is currently no known mitigation for this flaw.” RHSA-2020:5410
  • Red Hat Integration
    fixed: vendor fix “There is currently no known mitigation for this flaw.” RHSA-2021:2039
  • Red Hat Integration - Camel K - Tech-Preview 3
    fixed: vendor fix “There is currently no known mitigation for this flaw.” RHSA-2021:0811
  • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-jasypt 1.9.3-1.redhat_00002.1.el8eap, eap7-fge-btf 1.2.0-1.redhat_00007.1.el8eap, eap7-wildfly 7.3.4-3.GA_redhat_00003.1.el8eap, eap7-jackson-core 2.10.4-1.redhat_00002.1.el8eap, eap7-undertow 2.0.32-1.SP1_redhat_00001.1.el8eap, eap7-fge-msg-simple 1.1.0-1.redhat_00007.1.el8eap, +62 more
    fixed: vendor fix “There is currently no known mitigation for this flaw.” RHSA-2020:4401
  • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-jasypt 1.9.3-1.redhat_00002.1.el6eap, eap7-fge-btf 1.2.0-1.redhat_00007.1.el6eap, eap7-wildfly 7.3.4-3.GA_redhat_00003.1.el6eap, eap7-jackson-core 2.10.4-1.redhat_00002.1.el6eap, eap7-undertow 2.0.32-1.SP1_redhat_00001.1.el6eap, eap7-fge-msg-simple 1.1.0-1.redhat_00007.1.el6eap, +62 more
    fixed: vendor fix “There is currently no known mitigation for this flaw.” RHSA-2020:5340
  • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-jasypt 1.9.3-1.redhat_00002.1.el7eap, eap7-fge-btf 1.2.0-1.redhat_00007.1.el7eap, eap7-wildfly 7.3.4-3.GA_redhat_00003.1.el7eap, eap7-jackson-core 2.10.4-1.redhat_00002.1.el7eap, eap7-undertow 2.0.32-1.SP1_redhat_00001.1.el7eap, eap7-fge-msg-simple 1.1.0-1.redhat_00007.1.el7eap, +64 more
    fixed: vendor fix “There is currently no known mitigation for this flaw.” RHSA-2020:4401
  • Red Hat JBoss Enterprise Application Platform 7
    fixed: vendor fix “There is currently no known mitigation for this flaw.” RHSA-2020:4402
  • Red Hat OpenShift Container Platform 4.6 openshift4/ose-logging-elasticsearch6 v4.6.0-202104221811.p0
    fixed: vendor fix “There is currently no known mitigation for this flaw.” RHSA-2021:1429
  • Red Hat Single Sign-On 7
    fixed: vendor fix “There is currently no known mitigation for this flaw.” RHSA-2020:5533
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-maven35-jackson-databind 2.7.6-2.12.el7, rh-maven35-jackson-databind-javadoc 2.7.6-2.12.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-maven35-jackson-databind 2.7.6-2.12.el7, rh-maven35-jackson-databind-javadoc 2.7.6-2.12.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-maven35-jackson-databind 2.7.6-2.12.el7, rh-maven35-jackson-databind-javadoc 2.7.6-2.12.el7 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-maven35-jackson-databind 2.7.6-2.12.el7, rh-maven35-jackson-databind-javadoc 2.7.6-2.12.el7
    fixed: vendor fix “There is currently no known mitigation for this flaw.” RHSA-2020:4312
  • Red Hat RHDM 7.11.0
    fixed: vendor fix “There is currently no known mitigation for this flaw.” RHSA-2021:2476
  • Red Hat RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 rhvm 4.4.4.5-0.10.el8ev, ovirt-web-ui 1.6.6-1.el8ev, ovirt-engine 4.4.4.5-0.10.el8ev, vdsm-jsonrpc-java 1.6.0-1.el8ev, ovirt-engine-dwh 4.4.4.2-1.el8ev, ovirt-engine-setup 4.4.4.5-0.10.el8ev, +20 more
    fixed: vendor fix “There is currently no known mitigation for this flaw.” RHSA-2021:0381
  • Red Hat RHPAM 7.11.0
    fixed: vendor fix “There is currently no known mitigation for this flaw.” RHSA-2021:2475
  • Red Hat Text-Only RHOAR
    fixed: vendor fix “There is currently no known mitigation for this flaw.” RHSA-2020:5361
  • Red Hat Vert.x 3.9.4
    fixed: vendor fix “There is currently no known mitigation for this flaw.” RHSA-2020:4379
  • Red Hat Data Grid 8 jackson-databind Red Hat Enterprise Linux 9 jackson-databind, pki-jackson-databind Red Hat OpenShift Container Platform 4.6 openshift4/ose-ptp v4.6.0-202104221811.p0, openshift4/ose-sriov-cni v4.6.0-202104221811.p0, openshift4/ose-ghostunnel v4.6.0-202104221811.p0, openshift4/ose-descheduler v4.6.0-202104221811.p0, openshift4/ose-ptp-operator v4.6.0-202104221811.p0, openshift4/ose-egress-router v4.6.0-202104221811.p0, +41 more Red Hat RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 rhvm-branding-rhv 4.4.7-1.el8ev
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
31 d ago

Exploit prediction

17.71% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven com.fasterxml.jackson.core:jackson-databind
>=2.6.0, <2.6.7.4
>=2.7.0.0, <2.9.10.7
>=2.10.0.0, <2.10.5.1
2.6.7.4
2.9.10.7
2.10.5.1

Affected products

  • n/a jackson-databind

Classification

Weakness
  • CWE-611 Improper Restriction of XML External Entity Reference

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.