Log in Start free

Vulnerability · Published Jan 19, 2021 · Assigned by redhat

CVE-2021-20190

High 8.1

In plain English

A high-severity unsafe deserialization in jackson-databind. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 7.6% (higher than 95% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)7.6%top 5.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12jackson-databind2.12.1-1DEBIAN-CVE-2021-20190
Debian:13jackson-databind2.12.1-1DEBIAN-CVE-2021-20190
Debian:14jackson-databind2.12.1-1DEBIAN-CVE-2021-20190
Mavencom.fasterxml.jackson.core:jackson-databind2.9.10.7GHSA-5949-rw7g-wx7w
Mavencom.fasterxml.jackson.core:jackson-databind2.6.7.5GHSA-5949-rw7g-wx7w
Ubuntu:22.04:LTSjackson-databindno fix listedUBUNTU-CVE-2021-20190

Affected products (as reported)

VendorProductVersions
n/a jackson-databind jackson-databind 2.9.10.7

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References