CVE-2021-20190

Name of the Vulnerable Software and Affected Versions jackson-databind versions prior to 2.9.10.7 jackson-databind versions prior to 2.6.7.5

Description The issue is related to the jackson-databind library's handling of serialization gadgets and typing, which can lead to the restoration of untrusted data in memory. This can allow a remote attacker to execute arbitrary code, posing a threat to data confidentiality, integrity, and system availability.

Recommendations For versions prior to 2.9.10.7, update to version 2.9.10.7 or later to resolve the issue. For versions prior to 2.6.7.5, update to version 2.6.7.5 or later to resolve the issue. As a temporary workaround, consider restricting the interaction between serialization gadgets and typing to minimize the risk of exploitation.