What’s Vulnerable › Vulnerabilities
CVE-2020-36180: Unsafe Deserialization in jackson-databind
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 4.1% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2021-01-07 · updated 2026-08-25
- Weakness: CWE-502
Description
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.
Affected products
- Debian Linux: 9.0
- FasterXML jackson-databind: from 2.0.0 before 2.6.7.5; from 2.7.0 before 2.9.10.8 — fixed in 2.6.7.5, 2.9.10.8
- NetApp Cloud Backup: all versions
- NetApp Service Level Manager: all versions
- Oracle Corporation Oracle Agile PLM: 9.3.6
- Oracle Corporation Oracle Application Testing Suite: 13.3.0.1
- Oracle Autovue For Agile Product Lifecycle Management: 21.0.2
- Oracle Banking Corporate Lending Process Management: 14.2, 14.3, 14.5
- Oracle Banking Credit Facilities Process Management: 14.2, 14.3, 14.5
- Oracle Banking Extensibility Workbench: 14.2, 14.3, 14.5
- Oracle Banking Supply Chain Finance: 14.2, 14.3, 14.5
- Oracle Corporation Banking Treasury Management: 4.4
- Oracle Corporation Banking Virtual Account Management: 14.2.0, 14.3.0, 14.5.0
- Oracle Blockchain Platform: through 21.1.2
- Oracle Corporation Oracle Commerce Platform: from 11.3.0 through 11.3.2; 11.2.0
- Oracle Corporation Communications Billing and Revenue Management: 7.5.0.23.0, 12.0.0.3.0
- Oracle Communications Cloud Native Core Policy: 1.14.0
- Oracle Communications Cloud Native Core Unified Data Repository: 1.4.0
- Oracle Corporation Oracle Communications Convergent Charging Controller: 12.0.4.0.0
- Oracle Communications Diameter Signaling Route: from 8.0.0.0 through 8.5.0.0
- Oracle Communications Element Manager: from 8.2.0.0 through 8.2.4.0
- Oracle Communications Evolved Communications Application Server: 7.1
- Oracle Communications Instant Messaging Server: 10.0.1.5.0
- Oracle Communications Network Charging And Control: 12.0.4.0.0
- Oracle Communications Offline Mediation Controller: 12.0.0.3
- Oracle Corporation Communications Policy Management: 12.5.0
- Oracle Corporation Communications Pricing Design Center: 12.0.0.4.0
- Oracle Communications Services Gatekeeper: 7.0
- Oracle Communications Session Report Manager: from 8.0.0.0 through 8.2.2.1
- Oracle Communications Session Route Manager: from 8.2.0.0 through 8.2.2.1
How to fix
Upgrade to a fixed version: FasterXML jackson-databind 2.6.7.5, 2.9.10.8; Oracle Corporation JD Edwards EnterpriseOne Orchestrator 9.2.5.3; Oracle Corporation JD Edwards EnterpriseOne Tools 9.2.5.3; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.9.10.8, 2.6.7.5. Check the vendor advisory for mitigations.
References
- https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://github.com/FasterXML/jackson-databind/issues/3004
- https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html
- https://security.netapp.com/advisory/ntap-20210205-0005/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://github.com/FasterXML/jackson-databind/issues/3004
Get alerted when CVE-2020-36180 or the next vulnerability affects your stack