Serialization gadgets exploit in jackson-databind

高危 8.1CVE-2020-35491 · GHSA-r3gr-cxrf-hg25 · Published 17/12/2020 · updated 08/10/2026

要点

CVE-2020-35491 是影响 com.fasterxml.jackson.core:jackson-databind, jackson-databind (fasterxml), agile product lifecycle management (oracle) 的高危 (CVSS 8.1)漏洞。
未来 30 天内被利用的概率（EPSS）：7.8%，高于 94.6% 的漏洞。
修复：升级到 2.9.10.8 或更高版本。

Package	Affected versions	Patched versions
com.fasterxml.jackson.core:jackson-databind Maven	`≥ 2.0.0, < 2.9.10.8`	`2.9.10.8`
jackson-databind fasterxml	`≥ 2.0.0, < 2.9.10.8`	`2.9.10.8`
agile product lifecycle management oracle	`= 9.3.6`	No fix yet
application testing suite oracle	`= 13.3.0.1`	No fix yet
autovue for agile product lifecycle management oracle	`= 21.0.2`	No fix yet
banking platform oracle	`= 2.10.0= 2.6.2= 2.7.0= 2.7.1= 2.8.0= 2.9.0`	No fix yet
banking treasury management oracle	`= 14.4`	No fix yet
banking virtual account management oracle	`= 14.2.0= 14.3.0= 14.5.0`	No fix yet
blockchain platform oracle	`≤ 21.1.2`	No fix yet
communications cloud native core policy oracle	`= 1.14.0`	No fix yet
communications cloud native core unified data repository oracle	`= 1.4.0`	No fix yet
communications diameter signaling route oracle	`≥ 8.0.0.0, ≤ 8.5.0.0`	No fix yet
communications evolved communications application server oracle	`= 7.1`	No fix yet
communications instant messaging server oracle	`= 10.0.1.5.0`	No fix yet
communications offline mediation controller oracle	`= 12.0.0.3`	No fix yet
communications pricing design center oracle	`= 12.0.0.4.0`	No fix yet
communications services gatekeeper oracle	`= 7.0`	No fix yet
communications unified inventory management oracle	`= 7.4.1`	No fix yet
documaker oracle	`= 12.6.3= 12.6.4`	No fix yet
insurance policy administration j2ee oracle	`= 11.0.2`	No fix yet
retail customer management and segmentation foundation oracle	`≥ 16.0, ≤ 19.0`	No fix yet
retail merchandising system oracle	`= 15.0.3`	No fix yet
retail xstore point of service oracle	`= 16.0.6= 17.0.4= 18.0.3= 19.0.2`	No fix yet
sd-wan edge oracle	`= 9.0`	No fix yet
webcenter portal oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet

Description

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.

NVD description

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.

References

nvd.nist.gov/vuln/detail/CVE-2020-35491 · ADVISORY
FasterXML/jackson-databind · WEB
FasterXML/jackson-databind commit 41b8bdb · WEB
cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 · WEB
FasterXML/jackson-databind · PACKAGE
lists.debian.org/debian-lts-announce/2021/04/msg00025.html · WEB
security.netapp.com/advisory/ntap-20210122-0005 · WEB
oracle.com//security-alerts/cpujul2021.html · WEB
oracle.com/security-alerts/cpuApr2021.html · WEB
oracle.com/security-alerts/cpuapr2022.html · WEB
oracle.com/security-alerts/cpujan2022.html · WEB

com.fasterxml.jackson.core:jackson-databind 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free