Deserialization Vulnerability in FasterXML Jackson Databind Library
CVE-2020-36185

8.1HIGH

Key Information:

Vendor

Fasterxml

Status
Jackson-databind
Vendor
CVE Published:
6 January 2021

What is CVE-2020-36185?

A deserialization vulnerability exists in FasterXML's jackson-databind library, specifically in versions prior to 2.9.10.8. This issue arises due to improper handling of serialization gadgets, which can allow an attacker to control object parameters during deserialization. This may lead to unexpected behavior in applications that rely on jackson-databind for JSON processing, particularly when integrating with org.apache.tomcat.dbcp2.datasources.SharedPoolDataSource.

References

https://cowtowncoder.medium.com/on-jackson-cves-dont-pani...
x_refsource_MISC
https://github.com/FasterXML/jackson-databind/issues/2998
x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2021/04/msg0...
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.