Serialization Handling Flaw in Jackson Databind by FasterXML
CVE-2021-20190

8.1HIGH

Key Information:

Vendor

Fasterxml

Status
Jackson-databind
Vendor
CVE Published:
19 January 2021

What is CVE-2021-20190?

A vulnerability exists in jackson-databind, prior to version 2.9.10.7, involving improper handling of serialization gadgets in conjunction with type handling. This flaw can lead to significant risks concerning data confidentiality, data integrity, and overall system availability. Attackers could exploit this vulnerability to manipulate serialized data, potentially resulting in unauthorized access or data alteration.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

jackson-databind jackson-databind 2.9.10.7

References

https://github.com/FasterXML/jackson-databind/issues/2854
x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1916633
x_refsource_MISC
https://lists.apache.org/thread.html/r380e9257bacb8551ee6...
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.