Serialization Vulnerability in FasterXML Jackson Databind Affecting Multiple Versions
CVE-2020-36186

8.1HIGH

Key Information:

Vendor

Fasterxml

Status
Jackson-databind
Vendor
CVE Published:
6 January 2021

What is CVE-2020-36186?

FasterXML Jackson Databind prior to version 2.9.10.8 contains a vulnerability that mismanages serialization gadgets and typing interactions. This flaw is associated with the datasources component known as PerUserPoolDataSource in Apache Tomcat. Attackers may exploit this to affect application data flows, emphasizing the necessity for versions to be updated to mitigate potential risks and enhance security.

References

https://cowtowncoder.medium.com/on-jackson-cves-dont-pani...
x_refsource_MISC
https://github.com/FasterXML/jackson-databind/issues/2997
x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2021/04/msg0...
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.