CVE-2020-36181

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.

Affected products

Alt Linux, Apache Tomcat, Astra Linux, Jackson-Databind

Netapp Service Level Manager

All versions

Fix

Available

CVSS 3.1

8.8 HIGH

EPSS

5.0% (92th percentile)

Weakness

CWE-502

NVD status

Modified

Published

2021-01-06