CVE-2020-36189: Unsafe Deserialization in jackson-databind

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-01-06 · updated 2026-10-08
Weakness: CWE-502

Description

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

Affected products

Debian Linux: 9.0
FasterXML jackson-databind: from 2.0.0 before 2.6.7.5; from 2.7.0 before 2.9.10.8 — fixed in 2.6.7.5, 2.9.10.8
NetApp Cloud Backup: all versions
NetApp Service Level Manager: all versions
Oracle Corporation Oracle Agile PLM: 9.3.6
Oracle Corporation Oracle Application Testing Suite: 13.3.0.1
Oracle Autovue For Agile Product Lifecycle Management: 21.0.2
Oracle Banking Platform: 2.6.2, 2.7.0, 2.7.1, 2.8.0, 2.9.0, 2.10.0
Oracle Corporation Banking Treasury Management: 14.4
Oracle Corporation Banking Virtual Account Management: 14.2.0, 14.3.0, 14.5.0
Oracle Blockchain Platform: through 21.1.2
Oracle Corporation Oracle Commerce Platform: from 11.3.0 through 11.3.2; 11.2.0
Oracle Corporation Communications Billing and Revenue Management: 7.5.0.23.0, 12.0.0.3.0
Oracle Communications Cloud Native Core Policy: 1.14.0
Oracle Communications Cloud Native Core Unified Data Repository: 1.4.0
Oracle Corporation Oracle Communications Convergent Charging Controller: 12.0.4.0.0
Oracle Corporation Communications Diameter Signaling Router (DSR): from 8.0.0 through 8.5.0
Oracle Communications Evolved Communications Application Server: 7.1
Oracle Communications Instant Messaging Server: 10.0.1.5.0
Oracle Corporation Communications Interactive Session Recorder: 6.3, 6.4
Oracle Communications Messaging Server: 8.0.2, 8.1
Oracle Communications Network Charging And Control: 12.0.4.0.0
Oracle Communications Offline Mediation Controller: 12.0.0.3
Oracle Corporation Communications Pricing Design Center: 12.0.0.4.0
Oracle Communications Services Gatekeeper: 7.0
Oracle Communications Session Route Manager: from 8.2.0.0 through 8.2.2.1
Oracle Corporation Oracle Communications Unified Inventory Management: 7.4.1
Oracle Documaker: 12.6.3, 12.6.4
Oracle Goldengate Application Adapters: 19.1.0.0.0
Oracle Insurance Policy Administration: from 11.1.0 through 11.3.0; 11.0.2

How to fix

Upgrade to a fixed version: FasterXML jackson-databind 2.6.7.5, 2.9.10.8; Oracle Corporation JD Edwards EnterpriseOne Orchestrator 9.2.5.3; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.9.10.8, 2.6.7.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-36189 or the next vulnerability affects your stack