CVE-2020-8840 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2020-8840 Interim 1 7 2026-03-05T05:54:56Z current 2021-05-30T14:38:13Z 2026-03-05T05:54:56Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2020-8840 FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Liberty Linux 8 apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c bea-stax-api-1.2.0-16.module+el8.1.0+3366+6dfb954c glassfish-fastinfoset-1.2.13-9.module+el8.1.0+3366+6dfb954c glassfish-jaxb-api-2.2.12-8.module+el8.1.0+3366+6dfb954c glassfish-jaxb-core-2.2.11-11.module+el8.1.0+3366+6dfb954c glassfish-jaxb-runtime-2.2.11-11.module+el8.1.0+3366+6dfb954c glassfish-jaxb-txw2-2.2.11-11.module+el8.1.0+3366+6dfb954c jackson-annotations-2.10.0-1.module+el8.2.0+5059+3eb3af25 jackson-core-2.10.0-1.module+el8.2.0+5059+3eb3af25 jackson-databind-2.10.0-1.module+el8.2.0+5059+3eb3af25 jackson-jaxrs-json-provider-2.9.9-1.module+el8.1.0+3832+9784644d jackson-jaxrs-providers-2.9.9-1.module+el8.1.0+3832+9784644d jackson-module-jaxb-annotations-2.7.6-4.module+el8.1.0+3366+6dfb954c jakarta-commons-httpclient-3.1-28.module+el8.1.0+3366+6dfb954c javassist-3.18.1-8.module+el8.1.0+3366+6dfb954c javassist-javadoc-3.18.1-8.module+el8.1.0+3366+6dfb954c jss-4.6.2-4.module+el8.2.0+6123+b4678599 jss-javadoc-4.6.2-4.module+el8.2.0+6123+b4678599 ldapjdk-4.21.0-2.module+el8.2.0+4573+c3c38c7b ldapjdk-javadoc-4.21.0-2.module+el8.2.0+4573+c3c38c7b pki-base-10.8.3-1.module+el8.2.0+5925+bad5981a pki-base-java-10.8.3-1.module+el8.2.0+5925+bad5981a pki-ca-10.8.3-1.module+el8.2.0+5925+bad5981a pki-kra-10.8.3-1.module+el8.2.0+5925+bad5981a pki-server-10.8.3-1.module+el8.2.0+5925+bad5981a pki-servlet-4.0-api-9.0.7-16.module+el8.1.0+3366+6dfb954c pki-servlet-engine-9.0.7-16.module+el8.1.0+3366+6dfb954c pki-symkey-10.8.3-1.module+el8.2.0+5925+bad5981a pki-tools-10.8.3-1.module+el8.2.0+5925+bad5981a python-nss-doc-1.0.1-10.module+el8.1.0+3366+6dfb954c python3-nss-1.0.1-10.module+el8.1.0+3366+6dfb954c python3-pki-10.8.3-1.module+el8.2.0+5925+bad5981a relaxngDatatype-2011.1-7.module+el8.1.0+3366+6dfb954c resteasy-3.0.26-3.module+el8.1.0+3366+6dfb954c slf4j-1.7.25-4.module+el8.1.0+3366+6dfb954c slf4j-jdk14-1.7.25-4.module+el8.1.0+3366+6dfb954c stax-ex-1.7.7-8.module+el8.1.0+3366+6dfb954c tomcatjss-7.4.1-2.module+el8.2.0+4573+c3c38c7b velocity-1.7-24.module+el8.1.0+3366+6dfb954c xalan-j2-2.7.1-38.module+el8.1.0+3366+6dfb954c xerces-j2-2.11.0-34.module+el8.1.0+3366+6dfb954c xml-commons-apis-1.4.01-25.module+el8.1.0+3366+6dfb954c xml-commons-resolver-1.2-26.module+el8.1.0+3366+6dfb954c xmlstreambuffer-1.5.4-8.module+el8.1.0+3366+6dfb954c xsom-0-19.20110809svn.module+el8.1.0+3366+6dfb954c apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 bea-stax-api-1.2.0-16.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 glassfish-fastinfoset-1.2.13-9.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 glassfish-jaxb-api-2.2.12-8.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 glassfish-jaxb-core-2.2.11-11.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 glassfish-jaxb-runtime-2.2.11-11.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 glassfish-jaxb-txw2-2.2.11-11.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 jackson-annotations-2.10.0-1.module+el8.2.0+5059+3eb3af25 as a component of SUSE Liberty Linux 8 jackson-core-2.10.0-1.module+el8.2.0+5059+3eb3af25 as a component of SUSE Liberty Linux 8 jackson-databind-2.10.0-1.module+el8.2.0+5059+3eb3af25 as a component of SUSE Liberty Linux 8 jackson-jaxrs-json-provider-2.9.9-1.module+el8.1.0+3832+9784644d as a component of SUSE Liberty Linux 8 jackson-jaxrs-providers-2.9.9-1.module+el8.1.0+3832+9784644d as a component of SUSE Liberty Linux 8 jackson-module-jaxb-annotations-2.7.6-4.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 jakarta-commons-httpclient-3.1-28.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 javassist-3.18.1-8.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 javassist-javadoc-3.18.1-8.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 jss-4.6.2-4.module+el8.2.0+6123+b4678599 as a component of SUSE Liberty Linux 8 jss-javadoc-4.6.2-4.module+el8.2.0+6123+b4678599 as a component of SUSE Liberty Linux 8 ldapjdk-4.21.0-2.module+el8.2.0+4573+c3c38c7b as a component of SUSE Liberty Linux 8 ldapjdk-javadoc-4.21.0-2.module+el8.2.0+4573+c3c38c7b as a component of SUSE Liberty Linux 8 pki-base-10.8.3-1.module+el8.2.0+5925+bad5981a as a component of SUSE Liberty Linux 8 pki-base-java-10.8.3-1.module+el8.2.0+5925+bad5981a as a component of SUSE Liberty Linux 8 pki-ca-10.8.3-1.module+el8.2.0+5925+bad5981a as a component of SUSE Liberty Linux 8 pki-kra-10.8.3-1.module+el8.2.0+5925+bad5981a as a component of SUSE Liberty Linux 8 pki-server-10.8.3-1.module+el8.2.0+5925+bad5981a as a component of SUSE Liberty Linux 8 pki-servlet-4.0-api-9.0.7-16.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 pki-servlet-engine-9.0.7-16.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 pki-symkey-10.8.3-1.module+el8.2.0+5925+bad5981a as a component of SUSE Liberty Linux 8 pki-tools-10.8.3-1.module+el8.2.0+5925+bad5981a as a component of SUSE Liberty Linux 8 python-nss-doc-1.0.1-10.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 python3-nss-1.0.1-10.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 python3-pki-10.8.3-1.module+el8.2.0+5925+bad5981a as a component of SUSE Liberty Linux 8 relaxngDatatype-2011.1-7.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 resteasy-3.0.26-3.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 slf4j-1.7.25-4.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 slf4j-jdk14-1.7.25-4.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 stax-ex-1.7.7-8.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 tomcatjss-7.4.1-2.module+el8.2.0+4573+c3c38c7b as a component of SUSE Liberty Linux 8 velocity-1.7-24.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 xalan-j2-2.7.1-38.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 xerces-j2-2.11.0-34.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 xml-commons-apis-1.4.01-25.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 xml-commons-resolver-1.2-26.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 xmlstreambuffer-1.5.4-8.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 xsom-0-19.20110809svn.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter. CVE-2020-8840 SUSE Liberty Linux 8:apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:bea-stax-api-1.2.0-16.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:glassfish-fastinfoset-1.2.13-9.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:glassfish-jaxb-api-2.2.12-8.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:glassfish-jaxb-core-2.2.11-11.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:glassfish-jaxb-runtime-2.2.11-11.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:glassfish-jaxb-txw2-2.2.11-11.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:jackson-annotations-2.10.0-1.module+el8.2.0+5059+3eb3af25 SUSE Liberty Linux 8:jackson-core-2.10.0-1.module+el8.2.0+5059+3eb3af25 SUSE Liberty Linux 8:jackson-databind-2.10.0-1.module+el8.2.0+5059+3eb3af25 SUSE Liberty Linux 8:jackson-jaxrs-json-provider-2.9.9-1.module+el8.1.0+3832+9784644d SUSE Liberty Linux 8:jackson-jaxrs-providers-2.9.9-1.module+el8.1.0+3832+9784644d SUSE Liberty Linux 8:jackson-module-jaxb-annotations-2.7.6-4.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:jakarta-commons-httpclient-3.1-28.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:javassist-3.18.1-8.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:javassist-javadoc-3.18.1-8.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:jss-4.6.2-4.module+el8.2.0+6123+b4678599 SUSE Liberty Linux 8:jss-javadoc-4.6.2-4.module+el8.2.0+6123+b4678599 SUSE Liberty Linux 8:ldapjdk-4.21.0-2.module+el8.2.0+4573+c3c38c7b SUSE Liberty Linux 8:ldapjdk-javadoc-4.21.0-2.module+el8.2.0+4573+c3c38c7b SUSE Liberty Linux 8:pki-base-10.8.3-1.module+el8.2.0+5925+bad5981a SUSE Liberty Linux 8:pki-base-java-10.8.3-1.module+el8.2.0+5925+bad5981a SUSE Liberty Linux 8:pki-ca-10.8.3-1.module+el8.2.0+5925+bad5981a SUSE Liberty Linux 8:pki-kra-10.8.3-1.module+el8.2.0+5925+bad5981a SUSE Liberty Linux 8:pki-server-10.8.3-1.module+el8.2.0+5925+bad5981a SUSE Liberty Linux 8:pki-servlet-4.0-api-9.0.7-16.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:pki-servlet-engine-9.0.7-16.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:pki-symkey-10.8.3-1.module+el8.2.0+5925+bad5981a SUSE Liberty Linux 8:pki-tools-10.8.3-1.module+el8.2.0+5925+bad5981a SUSE Liberty Linux 8:python-nss-doc-1.0.1-10.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:python3-nss-1.0.1-10.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:python3-pki-10.8.3-1.module+el8.2.0+5925+bad5981a SUSE Liberty Linux 8:relaxngDatatype-2011.1-7.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:resteasy-3.0.26-3.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:slf4j-1.7.25-4.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:slf4j-jdk14-1.7.25-4.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:stax-ex-1.7.7-8.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:tomcatjss-7.4.1-2.module+el8.2.0+4573+c3c38c7b SUSE Liberty Linux 8:velocity-1.7-24.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:xalan-j2-2.7.1-38.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:xerces-j2-2.11.0-34.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:xml-commons-apis-1.4.01-25.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:xml-commons-resolver-1.2-26.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:xmlstreambuffer-1.5.4-8.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:xsom-0-19.20110809svn.module+el8.1.0+3366+6dfb954c critical 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H