PT-2020-3965 · Fasterxml+3 · Jackson-Databind+3

Published 2020-08-25 · Updated 2025-09-29 · CVE-2020-24616

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: FasterXML jackson-databind versions 2.x prior to 2.9.10.6

Description: The issue is related to the mishandling of the interaction between serialization gadgets and typing in FasterXML jackson-databind, specifically with the component br.com.anteros.dbcp.AnterosDBCPDataSource, also known as Anteros-DBCP. This can allow a remote attacker to impact data integrity, gain access to confidential data, and cause a denial of service.

Recommendations: For FasterXML jackson-databind versions 2.x prior to 2.9.10.6, update to version 2.9.10.6 or later to resolve the issue. As a temporary workaround, consider restricting the use of the br.com.anteros.dbcp.AnterosDBCPDataSource component until a patch is available.

Exploit

Fix

Deserialization of Untrusted Data

Code Injection

Weakness Enumeration

CWE-502

CWE-94

Related Identifiers

ALSA-2025_16880

ALT-PU-2021-1792

BDU:2020-04358

CVE-2020-24616

DLA-2638-1

GHSA-H3CW-G4MQ-C5X2

ROSA-SA-2025-2629

Affected Products

Alt Linux

Anterosdbcpdatasource

Astra Linux

Jackson-Databind

References · 30

• 🔥 https://github.com/0xkami/cve-2020-24616-poc · Exploit
• 🔥 https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 · Exploit
• https://github.com/FasterXML/jackson-databind/issues/2814 · Patch
• https://oracle.com/security-alerts/cpujan2021.html · Patch
• https://oracle.com/security-alerts/cpujan2022.html · Patch
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://oracle.com/security-alerts/cpuoct2021.html · Patch
• https://oracle.com/security-alerts/cpuApr2021.html · Patch
• https://osv.dev/vulnerability/GHSA-h3cw-g4mq-c5x2 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-24616 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-24616 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-24616 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-24616 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04358 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-24616 · Security Note