CVE-2020-28491
Denial of Service (DoS)
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.
Esto afecta al paquete com.fasterxml.jackson.dataformat:jackson-dataformat-cbor versiones desde 0 y anteriores a 2.11.4, versiones desde 2.12.0-rc1 y anteriores a 2.12.1. Una asignación no comprobada de búfer de bytes puede causar una excepción de java.lang.OutOfMemoryError
Red Hat Decision Manager is an open source decision management platform that combines business rules management, complex event processing, Decision Model & Notation execution, and Business Optimizer for solving planning problems. It automates business decisions and makes that logic available to the entire business. This release of Red Hat Decision Manager 7.12.0 serves as an update to Red Hat Decision Manager 7.11.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include code execution, denial of service, deserialization, and traversal vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-11-12 CVE Reserved
- 2021-02-18 CVE Published
- 2024-09-16 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-400: Uncontrolled Resource Consumption
- CWE-770: Allocation of Resources Without Limits or Throttling
CAPEC
References (6)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2020-28491 | 2022-03-02 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1930423 | 2022-03-02 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Fasterxml Search vendor "Fasterxml" | Jackson-dataformats-binary Search vendor "Fasterxml" for product "Jackson-dataformats-binary" | < 2.11.4 Search vendor "Fasterxml" for product "Jackson-dataformats-binary" and version " < 2.11.4" | - |
Affected
| ||||||
| Fasterxml Search vendor "Fasterxml" | Jackson-dataformats-binary Search vendor "Fasterxml" for product "Jackson-dataformats-binary" | > 2.12.0 < 2.12.1 Search vendor "Fasterxml" for product "Jackson-dataformats-binary" and version " > 2.12.0 < 2.12.1" | - |
Affected
| ||||||
| Fasterxml Search vendor "Fasterxml" | Jackson-dataformats-binary Search vendor "Fasterxml" for product "Jackson-dataformats-binary" | 2.12.0 Search vendor "Fasterxml" for product "Jackson-dataformats-binary" and version "2.12.0" | - |
Affected
| ||||||
| Fasterxml Search vendor "Fasterxml" | Jackson-dataformats-binary Search vendor "Fasterxml" for product "Jackson-dataformats-binary" | 2.12.0 Search vendor "Fasterxml" for product "Jackson-dataformats-binary" and version "2.12.0" | rc1 |
Affected
| ||||||
| Fasterxml Search vendor "Fasterxml" | Jackson-dataformats-binary Search vendor "Fasterxml" for product "Jackson-dataformats-binary" | 2.12.0 Search vendor "Fasterxml" for product "Jackson-dataformats-binary" and version "2.12.0" | rc2 |
Affected
| ||||||
| Quarkus Search vendor "Quarkus" | Quarkus Search vendor "Quarkus" for product "Quarkus" | < 2.0.2 Search vendor "Quarkus" for product "Quarkus" and version " < 2.0.2" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Weblogic Server Search vendor "Oracle" for product "Weblogic Server" | 12.2.1.3.0 Search vendor "Oracle" for product "Weblogic Server" and version "12.2.1.3.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Weblogic Server Search vendor "Oracle" for product "Weblogic Server" | 12.2.1.4.0 Search vendor "Oracle" for product "Weblogic Server" and version "12.2.1.4.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Weblogic Server Search vendor "Oracle" for product "Weblogic Server" | 14.1.1.0.0 Search vendor "Oracle" for product "Weblogic Server" and version "14.1.1.0.0" | - |
Affected
| ||||||