PT-2020-6950 · Fasterxml+3 · Jackson-Databind+3

Published 2020-12-17 · Updated 2025-01-28 · CVE-2020-35491

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.x before 2.9.10.8

Description The issue is related to the interaction between serialization gadgets and typing, which can lead to the exploitation of the vulnerability. This may allow a remote attacker to execute arbitrary code. The vulnerability is also related to the org.apache.commons.dbcp2.datasources.SharedPoolDataSource.

Recommendations For FasterXML jackson-databind versions 2.x before 2.9.10.8, update to version 2.9.10.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of serialization gadgets and typing to minimize the risk of exploitation. Additionally, restrict access to the org.apache.commons.dbcp2.datasources.SharedPoolDataSource to reduce the attack surface.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

CWE-913

Related Identifiers

ALT-PU-2021-1792

BDU:2024-00113

CVE-2020-35491

DLA-2638-1

GHSA-R3GR-CXRF-HG25

OESA-2021-1014

ROSA-SA-2025-2629

Affected Products

Alt Linux

Apache Commons Dbcp

Astra Linux

Jackson-Databind

References · 35

• 🔥 https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 · Exploit
• https://osv.dev/vulnerability/CVE-2020-35491 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2022.html · Patch
• https://bdu.fstec.ru/vul/2024-00113 · Security Note
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://oracle.com/security-alerts/cpuoct2021.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-35491 · Security Note
• https://oracle.com/security-alerts/cpuApr2021.html · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-35491 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r3gr-cxrf-hg25 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1014 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-35491 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35728 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-36185 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-35490 · Security Note