What’s Vulnerable › Vulnerabilities
CVE-2020-8840: Deserialization of Untrusted Data in jackson-databind
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 26.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-02-10 · updated 2026-10-08
- Weakness: CWE-502
Description
FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
Affected products
- Debian Linux: 8.0
- FasterXML jackson-databind: from 2.0.0 before 2.7.9.7; from 2.8.0 before 2.8.11.5; from 2.9.0 before 2.9.10.3 — fixed in 2.7.9.7, 2.8.11.5, 2.9.10.3
- Huawei Oceanstor 9000 Firmware: v300r006c20, v300r006c20spc100, v300r006c20spc200, v300r006c20spc300
- NetApp Oncommand Api Services: all versions
- NetApp OnCommand Workflow Automation: all versions
- NetApp Service Level Manager: all versions
- NetApp Steelstore Cloud Integrated Storage: all versions
- Oracle Global Lifecycle Management Opatch: before 11.2.0.3.23; from 12.2.0.1.0 before 12.2.0.1.19; from 13.9.4.0.0 before 13.9.4.2.1 — fixed in 11.2.0.3.23, 12.2.0.1.19, 13.9.4.2.1
- Maven Com.Fasterxml.Jackson.Core:Jackson-Databind: from 2.0.0 before 2.6.7.4; from 2.7.0 before 2.7.9.7; from 2.8.0 before 2.8.11.5; from 2.9.0 before 2.9.10.3; 2.0.0, 2.0.1, 2.0.2, 2.0.4, 2.0.5, 2.0.6 (+110) — fixed in 2.6.7.4, 2.7.9.7, 2.8.11.5, 2.9.10.3
How to fix
Upgrade to a fixed version: FasterXML jackson-databind 2.7.9.7, 2.8.11.5, 2.9.10.3; Oracle Global Lifecycle Management Opatch 11.2.0.3.23, 12.2.0.1.19, 13.9.4.2.1; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.6.7.4, 2.7.9.7, 2.8.11.5, 2.9.10.3. Check the vendor advisory for mitigations.
References
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200610-01-fastjason-en
- https://github.com/FasterXML/jackson-databind/issues/2620
- https://lists.apache.org/thread.html/r078e68a926ea6be12e8404e47f45aabf04bb4668e8265c0de41db6db%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/r1c09b9551f6953dbeca190a4c4b78198cdbb9825fce36f96fe3d8218%40%3Cdev.tomee.apache.org%3E
- https://lists.apache.org/thread.html/r1efc776fc6ce3387593deaa94bbdd296733b1b01408a39c8d1ab9e0e%40%3Cdev.ranger.apache.org%3E
- https://lists.apache.org/thread.html/r2fa8046bd47fb407ca09b5107a80fa6147ba4ebe879caae5c98b7657%40%3Cdev.ranger.apache.org%3E
- https://lists.apache.org/thread.html/r319f19c74e06c201b9d4e8b282a4e4b2da6dcda022fb46f007dd00d3%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r3539bd3a377991217d724879d239e16e86001c54160076408574e1da%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r3d20a2660b36551fd8257d479941782af4a7169582449fac1704bde2%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r428d068b2a4923f1a5a4f5fc6381b95205cfe7620169d16db78e9c71%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r446646c5588b10f5e02409ad580b12f314869009cdfbf844ca395cec%40%3Cdev.ranger.apache.org%3E
Get alerted when CVE-2020-8840 or the next vulnerability affects your stack