CVE-2020-35491

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.x before 2.9.10.8

Description The issue is related to the interaction between serialization gadgets and typing, which can lead to the exploitation of the vulnerability. This may allow a remote attacker to execute arbitrary code. The vulnerability is also related to the org.apache.commons.dbcp2.datasources.SharedPoolDataSource.

Recommendations For FasterXML jackson-databind versions 2.x before 2.9.10.8, update to version 2.9.10.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of serialization gadgets and typing to minimize the risk of exploitation. Additionally, restrict access to the org.apache.commons.dbcp2.datasources.SharedPoolDataSource to reduce the attack surface.