CVE-2020-24750
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
- CVSS 3.1
- 8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 7.3% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-25)
- CWE
- CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- fasterxml:jackson-databind
- oracle:agile_product_lifecycle_management
- oracle:application_testing_suite
- oracle:autovue_for_agile_product_lifecycle_management
- oracle:banking_corporate_lending_process_management
- oracle:banking_credit_facilities_process_management
- oracle:banking_liquidity_management
- oracle:banking_supply_chain_finance
- oracle:blockchain_platform
- oracle:communications_calendar_server
- oracle:communications_contacts_server
- oracle:communications_diameter_signaling_router
- oracle:communications_element_manager
- oracle:communications_instant_messaging_server
- oracle:communications_messaging_server
- oracle:communications_offline_mediation_controller
- oracle:communications_policy_management
- oracle:communications_pricing_design_center
- oracle:communications_services_gatekeeper
- oracle:communications_session_report_manager
- oracle:communications_session_route_manager
- oracle:communications_unified_inventory_management
- oracle:identity_manager_connector
- oracle:siebel_core_-_server_framework
- oracle:siebel_ui_framework
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qjw2-hr98-qgfh | Maven | com.fasterxml.jackson.core:jackson-databind | >=2.0 <2.6.7.5 | 2.6.7.5 |
| GHSA-qjw2-hr98-qgfh | Maven | com.fasterxml.jackson.core:jackson-databind | >=2.7.0 <2.9.10.6 | 2.9.10.6 |
References
- https://github.com/FasterXML/jackson-databind/commit/ad5a630174f08d279504bc51ebba8772fd71b86b
- https://github.com/FasterXML/jackson-databind/issues/2798
- https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html
- https://security.netapp.com/advisory/ntap-20201009-0003/
- https://www.oracle.com//security-alerts/cpujul2021.html