CVSS 3.1
8.1 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2020-36180
High (8.1). EPSS 4.1% chance of exploitation in the next 30 days. Fixed in com.fasterxml.jackson.core:jackson-databind 2.6.7.5, 2.9.10.8.
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.
Severity
- EPSS
- 4.1% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
- CWE
- CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- fasterxml:jackson-databind
- netapp:cloud_backup
- netapp:service_level_manager
- oracle:agile_product_lifecycle_management
- oracle:application_testing_suite
- oracle:autovue_for_agile_product_lifecycle_management
- oracle:banking_corporate_lending_process_management
- oracle:banking_credit_facilities_process_management
- oracle:banking_extensibility_workbench
- oracle:banking_supply_chain_finance
- oracle:banking_treasury_management
- oracle:banking_virtual_account_management
- oracle:blockchain_platform
- oracle:commerce_platform
- oracle:communications_billing_and_revenue_management
- oracle:communications_cloud_native_core_policy
- oracle:communications_cloud_native_core_unified_data_repository
- oracle:communications_convergent_charging_controller
- oracle:communications_diameter_signaling_route
- oracle:communications_element_manager
- oracle:communications_evolved_communications_application_server
- oracle:communications_instant_messaging_server
- oracle:communications_network_charging_and_control
- oracle:communications_offline_mediation_controller
- oracle:communications_policy_management
- oracle:communications_pricing_design_center
- oracle:communications_services_gatekeeper
- oracle:communications_session_report_manager
- oracle:communications_session_route_manager
- oracle:communications_unified_inventory_management
- oracle:data_integrator
- oracle:documaker
- oracle:goldengate_application_adapters
- oracle:insurance_policy_administration
- oracle:insurance_rules_palette
- oracle:jd_edwards_enterpriseone_orchestrator
- oracle:jd_edwards_enterpriseone_tools
- oracle:primavera_gateway
- oracle:primavera_unifier
- oracle:retail_customer_management_and_segmentation_foundation
- oracle:retail_merchandising_system
- oracle:retail_service_backbone
- oracle:retail_xstore_point_of_service
- oracle:webcenter_portal
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8c4j-34r4-xr8g | Maven | com.fasterxml.jackson.core:jackson-databind | >=2.7.0 <2.9.10.8 | 2.9.10.8 |
| GHSA-8c4j-34r4-xr8g | Maven | com.fasterxml.jackson.core:jackson-databind | >=2.0.0 <2.6.7.5 | 2.6.7.5 |
References
- https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://github.com/FasterXML/jackson-databind/issues/3004
- https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html
- https://security.netapp.com/advisory/ntap-20210205-0005/
- https://www.oracle.com//security-alerts/cpujul2021.html