CVE-2020-36186

high-risk

Published 2021-01-06

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.

Do I need to act?

2.4% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.1/10 High

NETWORK / HIGH complexity

Affected Products (20)

Jackson-Databind

Cloud Backup

Service Level Manager

Debian Linux

Agile Plm

Application Testing Suite

Autovue For Agile Product Lifecycle Management

Banking Corporate Lending Process Management

Banking Credit Facilities Process Management

Banking Extensibility Workbench

Banking Supply Chain Finance

Banking Treasury Management

Affected Vendors

Debian Oracle Netapp Fasterxml

References (20)

Exploit https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need...

Issue Tracking https://github.com/FasterXML/jackson-databind/issues/2997

Mailing List https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html

Third Party Advisory https://security.netapp.com/advisory/ntap-20210205-0005/

Patch https://www.oracle.com//security-alerts/cpujul2021.html

Third Party Advisory https://www.oracle.com/security-alerts/cpuApr2021.html

Patch https://www.oracle.com/security-alerts/cpuapr2022.html

Patch https://www.oracle.com/security-alerts/cpujan2022.html

Third Party Advisory https://www.oracle.com/security-alerts/cpujul2022.html

Patch https://www.oracle.com/security-alerts/cpuoct2021.html