PT-2021-7983 · Unknown+3 · Jackson-Databind+3
Msiddiqu
·
Published
2021-01-19
·
Updated
2025-09-12
·
CVE-2021-20190
CVSS v2.0
8.3
High
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:C |
Name of the Vulnerable Software and Affected Versions
jackson-databind versions prior to 2.9.10.7
jackson-databind versions prior to 2.6.7.5
Description
The issue is related to the jackson-databind library's handling of serialization gadgets and typing, which can lead to the restoration of untrusted data in memory. This can allow a remote attacker to execute arbitrary code, posing a threat to data confidentiality, integrity, and system availability.
Recommendations
For versions prior to 2.9.10.7, update to version 2.9.10.7 or later to resolve the issue.
For versions prior to 2.6.7.5, update to version 2.6.7.5 or later to resolve the issue.
As a temporary workaround, consider restricting the interaction between serialization gadgets and typing to minimize the risk of exploitation.
Fix
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Suse
Jackson-Databind