Unknown · Jackson-Databind · CVE-2021-20190
**Name of the Vulnerable Software and Affected Versions**
jackson-databind versions prior to 2.9.10.7
jackson-databind versions prior to 2.6.7.5
**Description**
The issue is related to the jackson-databind library's handling of serialization gadgets and typing, which can lead to the restoration of untrusted data in memory. This can allow a remote attacker to execute arbitrary code, posing a threat to data confidentiality, integrity, and system availability.
**Recommendations**
For versions prior to 2.9.10.7, update to version 2.9.10.7 or later to resolve the issue.
For versions prior to 2.6.7.5, update to version 2.6.7.5 or later to resolve the issue.
As a temporary workaround, consider restricting the interaction between serialization gadgets and typing to minimize the risk of exploitation.