PT-2021-3168 · Fasterxml+3 · Jackson-Databind+3

Published

2021-01-01

·

Updated

2025-01-28

·

CVE-2020-36187

CVSS v2.0

9.3

High

VectorAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.x before 2.9.10.8
Description The issue is related to the interaction between serialization gadgets and typing, specifically involving the org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource component. This can lead to the deserialization of untrusted data, potentially allowing a remote attacker to impact the confidentiality, integrity, and availability of protected information.
Recommendations For FasterXML jackson-databind versions 2.x before 2.9.10.8, update to version 2.9.10.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of the org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource component until a patch is available.

Exploit

Fix

Deserialization of Untrusted Data

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-502

Related Identifiers

ALT-PU-2021-1792
BDU:2021-02838
CVE-2020-36187
DLA-2638-1
GHSA-R695-7VR9-JGC2
OESA-2021-1051
ROSA-SA-2025-2629

Affected Products

Alt Linux
Apache Tomcat
Astra Linux
Jackson-Databind