CVE:CVE-2020-8840
CNNVD:CNNVD-202002-354
FasterXML jackson-databind是FasterXML公司的一个基于JAVA可以将XML和JSON等数据格式与JAVA对象进行转换的库。Jackson可以轻松的将Java对象转换成json对象和xml文档，同样也可以将json、xml转换成Java对象。
FasterXML jackson-databind 2.0.0版本至2.9.10.2版本中存在代码问题漏洞，该漏洞源于程序缺少xbean-reflect/JNDI黑名单类。攻击者可利用该漏洞执行代码。
solution:Upgrade fasterxml jackson-databind to a higher version than 2.7.9.7,2.8.11.5,2.9.10.3,and avoid the version [2.0.0,2.7.9.7),[2.8.0,2.8.11.5),[2.9.0,2.9.10.3); Upgrade debian debian_linux to a higher version than 8.0,and avoid the version 8.0; Upgrade netapp oncommand_api_services to a higher version than -; Upgrade netapp oncommand_workflow_automation to a higher version than -; Upgrade netapp service_level_manager to a higher version than -; Upgrade netapp steelstore_cloud_integrated_storage to a higher version than -; Upgrade huawei oceanstor_9000_firmware to a higher version than v300r006c20,v300r006c20spc100,v300r006c20spc200,v300r006c20spc300,and avoid the version v300r006c20,v300r006c20spc100,v300r006c20spc200,v300r006c20spc300; Upgrade oracle global_lifecycle_management_opatch to a higher version than 11.2.0.3.23,12.2.0.1.19,13.9.4.2.1,and avoid the version (,11.2.0.3.23),[12.2.0.1.0,12.2.0.1.19),[13.9.4.0.0,13.9.4.2.1)