CVE-2020-24750: High severity fasterxml jackson-databind vulnerability
A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.6. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality and system availability.
Other sources
FasterXML jackson-databind 2.x before 2.6.7.5 and from 2.7.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-24750?
CVE-2020-24750 is a vulnerability in jackson-databind versions prior to 2.9.10.6 which mishandles the interaction between serialization gadgets and typing.
What is the severity of CVE-2020-24750?
CVE-2020-24750 has a severity rating of 8.1, which is categorized as high.
How does CVE-2020-24750 impact data confidentiality?
CVE-2020-24750 poses a threat to data confidentiality.
How does CVE-2020-24750 impact system availability?
CVE-2020-24750 poses a threat to system availability.
How can I fix CVE-2020-24750?
To fix CVE-2020-24750, update to jackson-databind version 2.9.10.6 or higher.