What’s Vulnerable › Vulnerabilities

CVE-2020-24616: Code Injection in jackson-databind

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-08-25 · updated 2026-10-08
• Weakness: CWE-502

Description

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).

Affected products

• Debian Linux: 9.0
• FasterXML jackson-databind: from 2.0.0 before 2.9.10.6 — fixed in 2.9.10.6
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• Oracle Corporation Oracle Agile PLM: 9.3.6
• Oracle Corporation Oracle Application Testing Suite: 13.3.0.1
• Oracle Autovue For Agile Product Lifecycle Management: 21.0.2
• Oracle Corporation Oracle Banking Liquidity Management: 14.2, 14.3, 14.5
• Oracle Banking Supply Chain Finance: 14.2, 14.3, 14.5
• Oracle Blockchain Platform: before 21.1.2 — fixed in 21.1.2
• Oracle Communications Calendar Server: 8.0, 8.0.0.4.0
• Oracle Communications Cloud Native Core Unified Data Repository: 1.4.0
• Oracle Communications Contacts Server: 8.0, 8.0.0.5.0
• Oracle Corporation Communications Diameter Signaling Router (DSR): from 8.0.0 through 8.2.2
• Oracle Communications Element Manager: from 8.2.0 through 8.2.4.0
• Oracle Communications Evolved Communications Application Server: 7.1
• Oracle Communications Instant Messaging Server: 10.0.1.5.0
• Oracle Communications Messaging Server: 8.1
• Oracle Communications Offline Mediation Controller: 12.0.0.3
• Oracle Corporation Communications Policy Management: 12.5.0
• Oracle Corporation Communications Pricing Design Center: 12.0.0.4.0
• Oracle Communications Services Gatekeeper: 7.0
• Oracle Communications Session Report Manager: from 8.0.0.0 through 8.2.2.1
• Oracle Corporation Oracle Communications Unified Inventory Management: 7.4.1
• Oracle Corporation Oracle Identity Manager Connector: 11.1.1.5.0
• Oracle Corporation Siebel UI Framework: through 21.2
• Maven Com.Fasterxml.Jackson.Core:Jackson-Databind: from 2.0.0 before 2.9.10.6; 2.0.0, 2.0.1, 2.0.2, 2.0.4, 2.0.5, 2.0.6 (+123) — fixed in 2.9.10.6

How to fix

Upgrade to a fixed version: FasterXML jackson-databind 2.9.10.6; Oracle Blockchain Platform 21.1.2; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.9.10.6. Check the vendor advisory for mitigations.

References

• https://github.com/FasterXML/jackson-databind/issues/2814
• https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html
• https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
• https://security.netapp.com/advisory/ntap-20200904-0006/
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2021.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://github.com/FasterXML/jackson-databind/issues/2814
• https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html

Get alerted when CVE-2020-24616 or the next vulnerability affects your stack