PT-2020-4068 · Fasterxml+4 · Jackson-Databind+4
Published
2020-04-07
·
Updated
2025-07-10
·
CVE-2020-11619
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
FasterXML jackson-databind versions 2.x before 2.9.10.4
Description:
The issue is related to the interaction between serialization gadgets and typing in FasterXML jackson-databind, specifically with the org.springframework.aop.config.MethodLocatingFactoryBean component. This can be exploited by a remote attacker to execute arbitrary code in the target system. The vulnerability is associated with deficiencies in the deserialization mechanism.
Recommendations:
For FasterXML jackson-databind versions 2.x before 2.9.10.4, update to version 2.9.10.4 or later to resolve the issue. As a temporary workaround, consider disabling the use of the org.springframework.aop.config.MethodLocatingFactoryBean component until a patch is applied. Restrict access to sensitive data and minimize the use of deserialization to reduce the risk of exploitation.
Exploit
Fix
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Methodlocatingfactorybean
Red Os
Ubuntu
Jackson-Databind