Serialization Handling Flaw in Jackson Databind by FasterXML
CVE-2021-20190

8.1HIGH

Key Information:

Vendor

Fasterxml

Status
Jackson-databind
Vendor
CVE Published:
19 January 2021

What is CVE-2021-20190?

A vulnerability exists in jackson-databind, prior to version 2.9.10.7, involving improper handling of serialization gadgets in conjunction with type handling. This flaw can lead to significant risks concerning data confidentiality, data integrity, and overall system availability. Attackers could exploit this vulnerability to manipulate serialized data, potentially resulting in unauthorized access or data alteration.

Affected Version(s)

jackson-databind jackson-databind 2.9.10.7

References

https://github.com/FasterXML/jackson-databind/issues/2854
x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1916633
x_refsource_MISC
https://lists.apache.org/thread.html/r380e9257bacb8551ee6...
mailing-listx_refsource_MLIST

EPSS Score

7% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.