PT-2021-3160 · Fasterxml+3 · Jackson-Databind+3
CVE-2020-36179
·
Published
2021-01-01
·
Updated
2026-08-24
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
FasterXML jackson-databind versions 2.x before 2.9.10.8
FasterXML jackson-databind versions 2.6.7.5 and earlier
Description
The issue is related to the interaction between serialization gadgets and typing, specifically with
oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS. This can allow a remote attacker to impact the confidentiality, integrity, and availability of protected information.Recommendations
For FasterXML jackson-databind versions 2.x before 2.9.10.8, update to version 2.9.10.8 or later.
For FasterXML jackson-databind versions 2.6.7.5 and earlier, update to version 2.6.7.5 or later.
As a temporary workaround, consider disabling the use of
oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS until a patch is available.Exploit
Fix
DoS
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Apache Commons Dbcp
Astra Linux
Jackson-Databind