CVE-2020-36182

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.

Affected products

Alt Linux, Apache Tomcat, Astra Linux, Jackson-Databind

Fasterxml Jackson-databind

< 2.6.7.5, 2.9.10.8

Fix

Available

CVSS 3.1

8.8 HIGH

EPSS

5.0% (92th percentile)

Weakness

CWE-502

NVD status

Modified

Published

2021-01-06