cbcvebase.
CVE-2020-35728
published 2020-12-27

CVE-2020-35728: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…

PriorityP353high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
12.50%
96.2th percentile
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

Affected

70 ranges· showing 25
VendorProductVersion rangeFixed in
debiandebian_linux——
debianjackson-databind< jackson-databind 2.12.1-1 (bookworm)jackson-databind 2.12.1-1 (bookworm)
fasterxmljackson-databind>= 0 < 2.12.1-12.12.1-1
fasterxmljackson-databind>= 0 < 2.12.1-12.12.1-1
fasterxmljackson-databind>= 0 < 2.12.1-12.12.1-1
fasterxmljackson-databind>= 0 < 2.12.1-12.12.1-1
fasterxmljackson-databind>= 2.0.0 < 2.6.7.52.6.7.5
fasterxmljackson-databind>= 2.7.0 < 2.9.10.82.9.10.8
oracleagile_product_lifecycle_management——
oracleapplication_testing_suite——
oracleautovue——
oraclebanking_corporate_lending_process_management——
oraclebanking_corporate_lending_process_management——
oraclebanking_corporate_lending_process_management——
oraclebanking_credit_facilities_process_management——
oraclebanking_credit_facilities_process_management——
oraclebanking_credit_facilities_process_management——
oraclebanking_extensibility_workbench——
oraclebanking_extensibility_workbench——
oraclebanking_extensibility_workbench——
oraclebanking_supply_chain_finance——
oraclebanking_supply_chain_finance——
oraclebanking_supply_chain_finance——
oraclebanking_treasury_management——
oraclebanking_virtual_account_management——

Detection & IOCsextracted from sources · hover to see the quote

othercom.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool↗
  • →Flag deserialization attempts referencing the gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool in JSON payloads — presence of this class name in deserialized input is a strong indicator of exploitation. ↗
  • →Exploitation requires enableDefaultTyping() to be active OR @JsonTypeInfo configured with id.CLASS or id.MINIMAL_CLASS — audit application configs for these settings as a detection/triage signal. ↗
  • →Exploitation requires the gadget class to be present on the classpath (org.glassfish.web/javax.servlet.jsp.jstl / embedded Xalan); inventory classpath for this artifact as a risk indicator. ↗
  • →Exploitation also requires deserialization of data from untrusted/uncontrolled sources — monitor for externally supplied JSON being fed into jackson-databind deserialization endpoints. ↗
  • ·jackson-databind 2.10.0 and later introduced safe default typing and is NOT considered affected by this CVE; only 2.x versions before 2.9.10.8 are vulnerable. ↗
  • ·Platforms that ship the vulnerable component but do not enable the unsafe deserialization conditions (enableDefaultTyping / @JsonTypeInfo id.CLASS) have a lowered vulnerability impact and may not be exploitable. ↗

CVSS provenance

nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.1HIGH
vendor_debian8.1HIGH
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.