CVE-2020-24616High· 8.1▾ MidnightPoC availableFasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 44.6 · likelihood 1.9 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
9.4%
1 GitHub repo
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).
jackson-databind >= 2.0.0, < 2.9.10.6active_iq_unified_manageragile_product_lifecycle_management = 9.3.6application_testing_suite = 13.3.0.1autovue_for_agile_product_lifecycle_management = 21.0.2banking_liquidity_management = 14.2banking_liquidity_management = 14.3banking_liquidity_management = 14.5banking_supply_chain_finance = 14.2banking_supply_chain_finance = 14.3banking_supply_chain_finance = 14.5blockchain_platform < 21.1.2communications_calendar_server = 8.0communications_calendar_server = 8.0.0.4.0communications_cloud_native_core_unified_data_repository = 1.4.0communications_contacts_server = 8.0communications_contacts_server = 8.0.0.5.0communications_diameter_signaling_router >= 8.0.0, <= 8.2.2communications_element_manager >= 8.2.0, <= 8.2.4.0communications_evolved_communications_application_server = 7.1communications_instant_messaging_server = 10.0.1.5.0communications_messaging_server = 8.1communications_offline_mediation_controller = 12.0.0.3communications_policy_management = 12.5.0communications_pricing_design_center = 12.0.0.4.0communications_services_gatekeeper = 7.0communications_session_report_manager >= 8.0.0.0, <= 8.2.2.1communications_unified_inventory_management = 7.4.1identity_manager_connector = 11.1.1.5.0siebel_ui_framework <= 21.2debian_linux = 9.0Upgrade past the affected range:
jackson-databind 2.9.10.6blockchain_platform 21.1.2Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2020-35728High· 8.1FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/jav…
CVE-2020-11113High· 8.8FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
CVE-2020-36182High· 8.1FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.
CVE-2020-14061High· 8.1FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnect…
CVE-2020-11112High· 8.8FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).
CVE-2020-11111High· 8.8FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).