CVE-2020-36184

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.x before 2.9.10.8

Description The issue is related to the interaction between serialization gadgets and typing in the FasterXML jackson-databind library, specifically with the org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource component. This can lead to the exploitation of the vulnerability, potentially allowing a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For FasterXML jackson-databind versions 2.x before 2.9.10.8, update to version 2.9.10.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of the org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource component until a patch is applied.