CVSS 3.1
8.1 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2020-35728
High (8.1). EPSS 13% chance of exploitation in the next 30 days. Fixed in com.fasterxml.jackson.core:jackson-databind 2.9.10.8.
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).
Severity
- EPSS
- 13% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
- CWE
- CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- fasterxml:jackson-databind
- netapp:service_level_manager
- oracle:agile_product_lifecycle_management
- oracle:application_testing_suite
- oracle:autovue
- oracle:banking_corporate_lending_process_management
- oracle:banking_credit_facilities_process_management
- oracle:banking_extensibility_workbench
- oracle:banking_supply_chain_finance
- oracle:banking_treasury_management
- oracle:banking_virtual_account_management
- oracle:blockchain_platform
- oracle:commerce_platform
- oracle:communications_billing_and_revenue_management
- oracle:communications_cloud_native_core_policy
- oracle:communications_cloud_native_core_unified_data_repository
- oracle:communications_convergent_charging_controller
- oracle:communications_diameter_signaling_route
- oracle:communications_element_manager
- oracle:communications_evolved_communications_application_server
- oracle:communications_network_charging_and_control
- oracle:communications_policy_management
- oracle:communications_services_gatekeeper
- oracle:communications_session_report_manager
- oracle:communications_session_route_manager
- oracle:communications_unified_inventory_management
- oracle:data_integrator
- oracle:goldengate_application_adapters
- oracle:insurance_policy_administration
- oracle:insurance_rules_palette
- oracle:jd_edwards_enterpriseone_orchestrator
- oracle:jd_edwards_enterpriseone_tools
- oracle:primavera_gateway
- oracle:primavera_unifier
- oracle:retail_customer_management_and_segmentation_foundation
- oracle:retail_merchandising_system
- oracle:retail_service_backbone
- oracle:retail_xstore_point_of_service
- oracle:webcenter_portal
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-5r5r-6hpj-8gg9 | Maven | com.fasterxml.jackson.core:jackson-databind | >=2.0.0 <2.9.10.8 | 2.9.10.8 |
References
- https://github.com/FasterXML/jackson-databind/issues/2999
- https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html
- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://security.netapp.com/advisory/ntap-20210129-0007/
- https://www.oracle.com//security-alerts/cpujul2021.html