--- id: CVE-2020-24616 title: >- FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP). summary: >- FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP). severity: high cvss: 8.1 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-502 vendor: fasterxml product: jackson-databind affected: - 'jackson-databind >= 2.0.0, < 2.9.10.6' - active_iq_unified_manager - agile_product_lifecycle_management = 9.3.6 - application_testing_suite = 13.3.0.1 - autovue_for_agile_product_lifecycle_management = 21.0.2 - banking_liquidity_management = 14.2 - banking_liquidity_management = 14.3 - banking_liquidity_management = 14.5 - banking_supply_chain_finance = 14.2 - banking_supply_chain_finance = 14.3 - banking_supply_chain_finance = 14.5 - blockchain_platform < 21.1.2 - communications_calendar_server = 8.0 - communications_calendar_server = 8.0.0.4.0 - communications_cloud_native_core_unified_data_repository = 1.4.0 - communications_contacts_server = 8.0 - communications_contacts_server = 8.0.0.5.0 - 'communications_diameter_signaling_router >= 8.0.0, <= 8.2.2' - 'communications_element_manager >= 8.2.0, <= 8.2.4.0' - communications_evolved_communications_application_server = 7.1 - communications_instant_messaging_server = 10.0.1.5.0 - communications_messaging_server = 8.1 - communications_offline_mediation_controller = 12.0.0.3 - communications_policy_management = 12.5.0 - communications_pricing_design_center = 12.0.0.4.0 - communications_services_gatekeeper = 7.0 - 'communications_session_report_manager >= 8.0.0.0, <= 8.2.2.1' - communications_unified_inventory_management = 7.4.1 - identity_manager_connector = 11.1.1.5.0 - siebel_ui_framework <= 21.2 - debian_linux = 9.0 patched: - jackson-databind 2.9.10.6 - blockchain_platform 21.1.2 published: '2020-08-25' updated: '2026-08-25' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-24616' references: - url: 'https://github.com/FasterXML/jackson-databind/issues/2814' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html' label: cve@mitre.org - url: >- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20200904-0006/' label: cve@mitre.org - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujan2021.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: cve@mitre.org - url: 'https://github.com/FasterXML/jackson-databind/issues/2814' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20200904-0006/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: af854a3a-2127-422b-91ae-364da2661108 tags: - nvd - exploit-available epss: 0.0758 epssPercentile: 0.9431 ingestedAt: '2026-08-25T17:29:30.266Z' exploits: github: 1 githubRepos: - 'https://github.com/0xkami/cve-2020-24616-poc' checkedAt: '2026-09-25T08:20:37.531Z' exploitAvailable: true --- ## Overview FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP). ## Affected - `jackson-databind >= 2.0.0, < 2.9.10.6` - `active_iq_unified_manager` - `agile_product_lifecycle_management = 9.3.6` - `application_testing_suite = 13.3.0.1` - `autovue_for_agile_product_lifecycle_management = 21.0.2` - `banking_liquidity_management = 14.2` - `banking_liquidity_management = 14.3` - `banking_liquidity_management = 14.5` - `banking_supply_chain_finance = 14.2` - `banking_supply_chain_finance = 14.3` - `banking_supply_chain_finance = 14.5` - `blockchain_platform < 21.1.2` - `communications_calendar_server = 8.0` - `communications_calendar_server = 8.0.0.4.0` - `communications_cloud_native_core_unified_data_repository = 1.4.0` - `communications_contacts_server = 8.0` - `communications_contacts_server = 8.0.0.5.0` - `communications_diameter_signaling_router >= 8.0.0, <= 8.2.2` - `communications_element_manager >= 8.2.0, <= 8.2.4.0` - `communications_evolved_communications_application_server = 7.1` - `communications_instant_messaging_server = 10.0.1.5.0` - `communications_messaging_server = 8.1` - `communications_offline_mediation_controller = 12.0.0.3` - `communications_policy_management = 12.5.0` - `communications_pricing_design_center = 12.0.0.4.0` - `communications_services_gatekeeper = 7.0` - `communications_session_report_manager >= 8.0.0.0, <= 8.2.2.1` - `communications_unified_inventory_management = 7.4.1` - `identity_manager_connector = 11.1.1.5.0` - `siebel_ui_framework <= 21.2` - `debian_linux = 9.0` ## Remediation Upgrade past the affected range: - `jackson-databind 2.9.10.6` - `blockchain_platform 21.1.2`