PT-2021-3162 · Fasterxml+3 · Jackson-Databind+3
Published
2021-01-01
·
Updated
2025-01-28
·
CVE-2020-36180
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
FasterXML jackson-databind versions 2.x before 2.9.10.8
FasterXML jackson-databind versions 2.6.x before 2.6.7.5
Description
The issue is related to the interaction between serialization gadgets and typing, specifically with the org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS component. This can allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability is also related to the restoration of untrusted data in memory.
Recommendations
For FasterXML jackson-databind versions 2.x before 2.9.10.8, update to version 2.9.10.8 or later.
For FasterXML jackson-databind versions 2.6.x before 2.6.7.5, update to version 2.6.7.5 or later.
As a temporary workaround, consider disabling the use of the org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS component until a patch is available. Restrict access to sensitive data and functions that may be impacted by this issue to minimize the risk of exploitation.
Exploit
Fix
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Apache Commons Dbcp
Astra Linux
Jackson-Databind