CVE-2020-11111: High severity fasterxml jackson-databind vulnerability
A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
A vulnerability was found in Jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq. (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).
— Red Hat
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq. (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-11111?
CVE-2020-11111 is a vulnerability in FasterXML jackson-databind 2.x before 2.9.10.4 that allows a remote attacker to execute arbitrary code on the system by exploiting unsafe deserialization in org.apache.activemq.*.
How severe is CVE-2020-11111?
CVE-2020-11111 has a severity rating of 9.8 (Critical) according to the CVSS v3.1 rating system.
Which software versions are affected by CVE-2020-11111?
The vulnerability affects FasterXML jackson-databind versions 2.x, specifically versions prior to 2.9.10.4.
How can I fix CVE-2020-11111?
To fix CVE-2020-11111, update FasterXML jackson-databind to version 2.9.10.4 or later.
Where can I find more information about CVE-2020-11111?
More information about CVE-2020-11111 can be found in the references provided: [GitHub](https://github.com/FasterXML/jackson-databind/issues/2664), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1821307), [GitHub Commit](https://github.com/FasterXML/jackson-databind/commit/05d7e0e13f43e12db6a51726df12c8b4d8040676)