PT-2021-3161 · Fasterxml+2 · Jackson-Databind+2

Published

2021-01-01

·

Updated

2025-01-28

·

CVE-2020-36183

CVSS v2.0

9.3

High

VectorAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.x before 2.9.10.8 FasterXML jackson-databind versions 2.6.7.5 and earlier
Description The issue is related to the interaction between serialization gadgets and typing, specifically with the org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool component. This can allow a remote attacker to impact the confidentiality, integrity, and availability of protected information.
Recommendations For FasterXML jackson-databind versions 2.x before 2.9.10.8, update to version 2.9.10.8 or later. For FasterXML jackson-databind versions 2.6.7.5 and earlier, update to version 2.6.7.5 or later. As a temporary workaround, consider disabling the use of the org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool component until a patch is available.

Exploit

Fix

Deserialization of Untrusted Data

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-502

Related Identifiers

ALT-PU-2021-1792
BDU:2021-02831
CVE-2020-36183
DLA-2638-1
GHSA-9M6F-7XCQ-8VF8
OESA-2021-1051
ROSA-SA-2025-2629

Affected Products

Alt Linux
Astra Linux
Jackson-Databind