CVE-2020-35728: High severity fasterxml jackson-databind vulnerability
Published Dec 23, 2020
·Updated
A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).
Affected Software
73 affected componentsFixes available
maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<=2.9.10.7
2.9.10.8
fasterxml jackson-databind>=2.9.0<2.9.10.8
Debian Debian Linux=9.0
NetApp Service Level Manager
Oracle Agile PLM=9.3.6
Oracle Application Testing Suite=13.3.0.1
Oracle AutoVue=21.0.2
Oracle Banking Corporate Lending Process Management=14.2
Oracle Banking Corporate Lending Process Management=14.3
Oracle Banking Corporate Lending Process Management=14.5
Oracle Banking Credit Facilities Process Management=14.2
Oracle Banking Credit Facilities Process Management=14.3
Oracle Banking Credit Facilities Process Management=14.5
Oracle Banking Extensibility Workbench=14.2
Oracle Banking Extensibility Workbench=14.3
Oracle Banking Extensibility Workbench=14.5
Oracle Banking Supply Chain Finance=14.2
Oracle Banking Supply Chain Finance=14.3
Oracle Banking Supply Chain Finance=14.5
Oracle Banking Treasury Management=14.4
Oracle Banking Virtual Account Management=14.2.0
Oracle Banking Virtual Account Management=14.3.0
Oracle Banking Virtual Account Management=14.5.0
Oracle Blockchain Platform<=21.1.2
Oracle Commerce Platform>=11.3.0<=11.3.2
Oracle Commerce Platform=11.2.0
Oracle Communications Billing and Revenue Management=7.5.0.23.0
Oracle Communications Billing and Revenue Management=12.0.0.3.0
Oracle Communications Cloud Native Core Policy=1.14.0
Oracle Communications Cloud Native Core Unified Data Repository=1.4.0
Oracle Communications Convergent Charging Controller=12.0.4.0.0
Oracle Communications Diameter Signaling Route>=8.0.0.0<=8.5.0.0
Oracle Communications Element Manager>=8.2.0.0<=8.2.4.0
Oracle Communications Evolved Communications Application Server=7.1
Oracle Communications Network Charging And Control=12.0.4.0.0
Oracle Communications Policy Management=12.5.0
Oracle Communications Services Gatekeeper=7.0
Oracle Communications Session Report Manager>=8.0.0.0<=8.2.2.1
Oracle Communications Session Route Manager>=8.2.0.0<=8.2.2.1
Oracle Communications Unified Inventory Management=7.4.1
Oracle Data Integrator=12.2.1.4.0
Oracle Goldengate Application Adapters=19.1.0.0.0
Oracle Insurance Policy Administration>=11.1.0<=11.3.0
Oracle Insurance Policy Administration=11.0.2
Oracle Insurance Rules Palette>=11.1.0<=11.3.0
Oracle Insurance Rules Palette=11.0.2
Oracle JD Edwards EnterpriseOne Orchestrator<9.2.5.3
Oracle JD Edwards EnterpriseOne Tools<9.2.5.3
Oracle Primavera Gateway>=17.12.0<=17.12.11
Oracle Primavera Gateway>=18.8.0<=18.8.11
Oracle Primavera Gateway>=19.12.0<=19.12.10
Oracle Primavera Gateway=20.12.0
Oracle Primavera Unifier>=17.7<=17.12
Oracle Primavera Unifier>=18.8<=19.12
Oracle Primavera Unifier=20.12
Oracle Retail Customer Management and Segmentation Foundation>=16.0<=19.0
Oracle Retail Merchandising System=15.0.3
Oracle Retail Service Backbone=14.1.3.2
Oracle Retail Service Backbone=15.0.3.1
Oracle Retail Service Backbone=16.0.3.0
Oracle Retail Xstore Point of Service=16.0.6
Oracle Retail Xstore Point of Service=17.0.4
Oracle Retail Xstore Point of Service=18.0.3
Oracle Retail Xstore Point of Service=19.0.2
Oracle WebCenter Portal=12.2.1.3.0
Oracle WebCenter Portal=12.2.1.4.0
IBM Security Verify Information Queue<=10.0.8
IBM Security Verify Information Queue<=10.0.7
IBM Security Verify Information Queue<=10.0.6
IBM Security Verify Information Queue<=10.0.5
redhat/jackson-databind<2.9.10.8
2.9.10.8
fasterxml jackson-databind>=2.0.0<2.6.7.5
fasterxml jackson-databind>=2.7.0<2.9.10.8
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Information
The following conditions are needed for an exploit, we recommend avoiding all if possible:
* Deserialization from sources you do not control
* `enableDefaultTyping()`
* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`
* avoid com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool in the classpath
Event History
Dec 23, 2020
CVE Published
12:00 AM
Data Sourced
12:00 AM
RemedyDescriptionSeverityWeaknessAffected Software
Dec 27, 2020
CVE Published
via MITRE·04:32 AM
Data Sourced
via MITRE·04:32 AM
Description
Data Sourced
via NVD·05:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Dec 29, 2020
Data Sourced
via Red Hat·07:48 PM
DescriptionSeverityAffected Software
Dec 9, 2021
Advisory Published
07:15 PM
Sep 10, 2025
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
1
What is CVE-2020-35728?
CVE-2020-35728 is a vulnerability in the FasterXML jackson-databind library.
2
How severe is CVE-2020-35728?
CVE-2020-35728 has a severity rating of 8.1 (high).
3
What is the affected software by CVE-2020-35728?
The affected software is jackson-databind version up to but excluding 2.9.10.8.
4
What is the CWE of CVE-2020-35728?
The CWE of CVE-2020-35728 is CWE-96.
5
How can CVE-2020-35728 be fixed?
To fix CVE-2020-35728, you need to update jackson-databind to version 2.9.10.8.