CVE-2020-8840 – jackson-databind: Lacks certain xbean-reflect/JNDI blocking

https://notcve.org/view.php?id=CVE-2020-8840

10 Feb 2020 — FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter. FasterXML jackson-databind versiones 2.0.0 hasta 2.9.10.2, carece de cierto bloqueo de xbean-reflect/JNDI, como es demostrado mediante org.apache.xbean.propertyeditor.JndiConverter. A flaw was found in FasterXML jackson-databind in versions 2.0.0 through 2.9.10.2. A "gadget" exploit is possible due to a lack of a Java object being blocking from being ... • https://github.com/jas502n/jackson-CVE-2020-8840 • CWE-502: Deserialization of Untrusted Data •