CVE-2020-35728: High severity fasterxml jackson-databind vulnerability

Published Dec 23, 2020
·
Updated

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Other sources

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

Affected Software

73 affected componentsFixes available
maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<=2.9.10.7
2.9.10.8
fasterxml jackson-databind>=2.9.0<2.9.10.8
Debian Debian Linux=9.0
NetApp Service Level Manager
Oracle Agile PLM=9.3.6
Oracle Application Testing Suite=13.3.0.1
Oracle AutoVue=21.0.2
Oracle Banking Corporate Lending Process Management=14.2
Oracle Banking Corporate Lending Process Management=14.3
Oracle Banking Corporate Lending Process Management=14.5
Oracle Banking Credit Facilities Process Management=14.2
Oracle Banking Credit Facilities Process Management=14.3
Oracle Banking Credit Facilities Process Management=14.5
Oracle Banking Extensibility Workbench=14.2
Oracle Banking Extensibility Workbench=14.3
Oracle Banking Extensibility Workbench=14.5
Oracle Banking Supply Chain Finance=14.2
Oracle Banking Supply Chain Finance=14.3
Oracle Banking Supply Chain Finance=14.5
Oracle Banking Treasury Management=14.4
Oracle Banking Virtual Account Management=14.2.0
Oracle Banking Virtual Account Management=14.3.0
Oracle Banking Virtual Account Management=14.5.0
Oracle Blockchain Platform<=21.1.2
Oracle Commerce Platform>=11.3.0<=11.3.2
Oracle Commerce Platform=11.2.0
Oracle Communications Billing and Revenue Management=7.5.0.23.0
Oracle Communications Billing and Revenue Management=12.0.0.3.0
Oracle Communications Cloud Native Core Policy=1.14.0
Oracle Communications Cloud Native Core Unified Data Repository=1.4.0
Oracle Communications Convergent Charging Controller=12.0.4.0.0
Oracle Communications Diameter Signaling Route>=8.0.0.0<=8.5.0.0
Oracle Communications Element Manager>=8.2.0.0<=8.2.4.0
Oracle Communications Evolved Communications Application Server=7.1
Oracle Communications Network Charging And Control=12.0.4.0.0
Oracle Communications Policy Management=12.5.0
Oracle Communications Services Gatekeeper=7.0
Oracle Communications Session Report Manager>=8.0.0.0<=8.2.2.1
Oracle Communications Session Route Manager>=8.2.0.0<=8.2.2.1
Oracle Communications Unified Inventory Management=7.4.1
Oracle Data Integrator=12.2.1.4.0
Oracle Goldengate Application Adapters=19.1.0.0.0
Oracle Insurance Policy Administration>=11.1.0<=11.3.0
Oracle Insurance Policy Administration=11.0.2
Oracle Insurance Rules Palette>=11.1.0<=11.3.0
Oracle Insurance Rules Palette=11.0.2
Oracle JD Edwards EnterpriseOne Orchestrator<9.2.5.3
Oracle JD Edwards EnterpriseOne Tools<9.2.5.3
Oracle Primavera Gateway>=17.12.0<=17.12.11
Oracle Primavera Gateway>=18.8.0<=18.8.11
Oracle Primavera Gateway>=19.12.0<=19.12.10
Oracle Primavera Gateway=20.12.0
Oracle Primavera Unifier>=17.7<=17.12
Oracle Primavera Unifier>=18.8<=19.12
Oracle Primavera Unifier=20.12
Oracle Retail Customer Management and Segmentation Foundation>=16.0<=19.0
Oracle Retail Merchandising System=15.0.3
Oracle Retail Service Backbone=14.1.3.2
Oracle Retail Service Backbone=15.0.3.1
Oracle Retail Service Backbone=16.0.3.0
Oracle Retail Xstore Point of Service=16.0.6
Oracle Retail Xstore Point of Service=17.0.4
Oracle Retail Xstore Point of Service=18.0.3
Oracle Retail Xstore Point of Service=19.0.2
Oracle WebCenter Portal=12.2.1.3.0
Oracle WebCenter Portal=12.2.1.4.0
IBM Security Verify Information Queue<=10.0.8
IBM Security Verify Information Queue<=10.0.7
IBM Security Verify Information Queue<=10.0.6
IBM Security Verify Information Queue<=10.0.5
redhat/jackson-databind<2.9.10.8
2.9.10.8
fasterxml jackson-databind>=2.0.0<2.6.7.5
fasterxml jackson-databind>=2.7.0<2.9.10.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade maven/com.fasterxml.jackson.core:jackson-databind to a version that resolves this vulnerability.

    Fixed in 2.9.10.8
  2. Upgrade

    Upgrade redhat/jackson-databind to a version that resolves this vulnerability.

    Fixed in 2.9.10.8
  3. Remove

    Remove com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool from your environment.

    Remove com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (embedded Xalan) from the application classpath if it is not required.

  4. Configuration

    Do not call ObjectMapper.enableDefaultTyping(); disable default typing in your ObjectMapper configuration.

    jackson-databind enableDefaultTyping() = disabled
  5. Configuration

    Avoid using @JsonTypeInfo with use = id.CLASS or id.MINIMAL_CLASS; remove or replace polymorphic typing annotations that disclose or rely on concrete class names.

    Jackson @JsonTypeInfo use = avoid id.CLASS and id.MINIMAL_CLASS
  6. Compensating control

    Avoid deserialization of data from sources you do not control. Restrict or authenticate endpoints that accept serialized data, validate or whitelist allowed types, or otherwise block untrusted inputs prior to deserialization.

Event History

Dec 23, 2020
CVE Published
12:00 AM
Data Sourced
12:00 AM
RemedyDescriptionSeverityWeaknessAffected Software
Dec 27, 2020
CVE Published
via MITRE·04:32 AM
Data Sourced
via MITRE·04:32 AM
Description
Data Sourced
via NVD·05:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Dec 29, 2020
Data Sourced
via Red Hat·07:48 PM
DescriptionSeverityAffected Software
Dec 9, 2021
Advisory Published
07:15 PM
Sep 10, 2025
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is CVE-2020-35728?

CVE-2020-35728 is a vulnerability in the FasterXML jackson-databind library.

2

How severe is CVE-2020-35728?

CVE-2020-35728 has a severity rating of 8.1 (high).

3

What is the affected software by CVE-2020-35728?

The affected software is jackson-databind version up to but excluding 2.9.10.8.

4

What is the CWE of CVE-2020-35728?

The CWE of CVE-2020-35728 is CWE-96.

5

How can CVE-2020-35728 be fixed?

To fix CVE-2020-35728, you need to update jackson-databind to version 2.9.10.8.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203