PT-2020-4194 · Fasterxml+4 · Jackson-Databind+4

Published 2020-06-14 · Updated 2025-08-27 · CVE-2020-14061

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: FasterXML jackson-databind versions 2.x before 2.9.10.5

Description: The issue is related to the deserialization mechanism in the Jackson-databind library. It can be exploited by a remote attacker to execute arbitrary code. The vulnerability is associated with the interaction between serialization gadgets and typing, particularly with certain Oracle JMS connection factories, including oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory.

Recommendations: For FasterXML jackson-databind versions 2.x before 2.9.10.5, update to version 2.9.10.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of the affected Oracle JMS connection factories until a patch is applied.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

ALT-PU-2021-1792

BDU:2020-04628

CVE-2020-14061

DLA-2270-1

GHSA-C2Q3-4QRH-FM48

MGASA-2021-0153

RHSA-2020:4366

ROSA-SA-2025-2629

USN-4813-1

Affected Products

Alt Linux

Oracle Jms

Red Os

Ubuntu

Jackson-Databind

References · 87

• 🔥 https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 · Exploit
• https://github.com/FasterXML/jackson-databind/issues/2698 · Patch
• https://ubuntu.com/security/CVE-2020-9548 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-10673 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2270-1 · Vendor Advisory
• https://debian.org/lts/security/2019/dla-2030 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-10968 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14195 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04628 · Security Note
• https://ubuntu.com/security/CVE-2020-9547 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-8840 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-14061 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11111 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-14061 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-12086 · Vendor Advisory