CVE-2020-11112: High severity fasterxml jackson-databind vulnerability
A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
A vulnerability was found in Jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).
— Red Hat
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-11112?
CVE-2020-11112 is a vulnerability found in FasterXML jackson-databind 2.x before 2.9.10.4 that mishandles the interaction between serialization gadgets and typing.
What is the severity of CVE-2020-11112?
The severity of CVE-2020-11112 is high, with a CVSS score of 8.1.
How does CVE-2020-11112 affect the system?
CVE-2020-11112 can lead to data confidentiality and integrity compromises, as well as system availability issues.
Which software versions are affected by CVE-2020-11112?
FasterXML jackson-databind 2.x up to but excluding 2.9.10.4 is affected by CVE-2020-11112.
How can CVE-2020-11112 be fixed?
To fix CVE-2020-11112, update FasterXML jackson-databind to version 2.9.10.4 or later.