CVE-2020-24750

jackson-databind: Serialization gadgets in com.pastdev.httpcomponents.configuration.JndiConfiguration

Severity Score

8.1

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.

FasterXML jackson-databind versiones 2.x anteriores a 2.9.10.6, maneja inapropiadamente la interacción entre los gadgets de serialización y la escritura, relacionada con com.pastdev.httpcomponents.configuration.JndiConfiguration

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.6. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality and system availability.

*Credits: N/A

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-08-28 CVE Reserved
2020-09-17 CVE Published
2021-01-25 First Exploit
2024-08-04 CVE Updated
2024-08-08 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-502: Deserialization of Untrusted Data

CAPEC

References (13)

URL	Tag	Source
https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html	Mailing List
https://security.netapp.com/advisory/ntap-20201009-0003	Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html	Third Party Advisory

URL	Date	SRC
https://github.com/Al1ex/CVE-2020-24750	2021-01-25

URL	Date	SRC
https://github.com/FasterXML/jackson-databind/commit/ad5a630174f08d279504bc51ebba8772fd71b86b	2023-09-13
https://github.com/FasterXML/jackson-databind/issues/2798	2023-09-13
https://www.oracle.com//security-alerts/cpujul2021.html	2023-09-13
https://www.oracle.com/security-alerts/cpuApr2021.html	2023-09-13
https://www.oracle.com/security-alerts/cpuapr2022.html	2023-09-13
https://www.oracle.com/security-alerts/cpujan2022.html	2023-09-13
https://www.oracle.com/security-alerts/cpuoct2021.html	2023-09-13

URL	Date	SRC
https://access.redhat.com/security/cve/CVE-2020-24750	2021-05-06
https://bugzilla.redhat.com/show_bug.cgi?id=1882310	2021-05-06

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Fasterxml Search vendor "Fasterxml"		Jackson-databind Search vendor "Fasterxml" for product "Jackson-databind"				>= 2.0.0 < 2.6.7.5 Search vendor "Fasterxml" for product "Jackson-databind" and version " >= 2.0.0 < 2.6.7.5"		-		Affected
Fasterxml Search vendor "Fasterxml"		Jackson-databind Search vendor "Fasterxml" for product "Jackson-databind"				>= 2.7.0 < 2.9.10.6 Search vendor "Fasterxml" for product "Jackson-databind" and version " >= 2.7.0 < 2.9.10.6"		-		Affected
Oracle Search vendor "Oracle"		Agile Plm Search vendor "Oracle" for product "Agile Plm"				9.3.6 Search vendor "Oracle" for product "Agile Plm" and version "9.3.6"		-		Affected
Oracle Search vendor "Oracle"		Application Testing Suite Search vendor "Oracle" for product "Application Testing Suite"				13.3.0.1 Search vendor "Oracle" for product "Application Testing Suite" and version "13.3.0.1"		-		Affected
Oracle Search vendor "Oracle"		Autovue For Agile Product Lifecycle Management Search vendor "Oracle" for product "Autovue For Agile Product Lifecycle Management"				21.0.2 Search vendor "Oracle" for product "Autovue For Agile Product Lifecycle Management" and version "21.0.2"		-		Affected
Oracle Search vendor "Oracle"		Banking Corporate Lending Process Management Search vendor "Oracle" for product "Banking Corporate Lending Process Management"				14.2.0 Search vendor "Oracle" for product "Banking Corporate Lending Process Management" and version "14.2.0"		-		Affected
Oracle Search vendor "Oracle"		Banking Corporate Lending Process Management Search vendor "Oracle" for product "Banking Corporate Lending Process Management"				14.3.0 Search vendor "Oracle" for product "Banking Corporate Lending Process Management" and version "14.3.0"		-		Affected
Oracle Search vendor "Oracle"		Banking Corporate Lending Process Management Search vendor "Oracle" for product "Banking Corporate Lending Process Management"				14.5.0 Search vendor "Oracle" for product "Banking Corporate Lending Process Management" and version "14.5.0"		-		Affected
Oracle Search vendor "Oracle"		Banking Credit Facilities Process Management Search vendor "Oracle" for product "Banking Credit Facilities Process Management"				14.2.0 Search vendor "Oracle" for product "Banking Credit Facilities Process Management" and version "14.2.0"		-		Affected
Oracle Search vendor "Oracle"		Banking Credit Facilities Process Management Search vendor "Oracle" for product "Banking Credit Facilities Process Management"				14.3.0 Search vendor "Oracle" for product "Banking Credit Facilities Process Management" and version "14.3.0"		-		Affected
Oracle Search vendor "Oracle"		Banking Credit Facilities Process Management Search vendor "Oracle" for product "Banking Credit Facilities Process Management"				14.5.0 Search vendor "Oracle" for product "Banking Credit Facilities Process Management" and version "14.5.0"		-		Affected
Oracle Search vendor "Oracle"		Banking Liquidity Management Search vendor "Oracle" for product "Banking Liquidity Management"				14.2 Search vendor "Oracle" for product "Banking Liquidity Management" and version "14.2"		-		Affected
Oracle Search vendor "Oracle"		Banking Liquidity Management Search vendor "Oracle" for product "Banking Liquidity Management"				14.3 Search vendor "Oracle" for product "Banking Liquidity Management" and version "14.3"		-		Affected
Oracle Search vendor "Oracle"		Banking Liquidity Management Search vendor "Oracle" for product "Banking Liquidity Management"				14.5 Search vendor "Oracle" for product "Banking Liquidity Management" and version "14.5"		-		Affected
Oracle Search vendor "Oracle"		Banking Supply Chain Finance Search vendor "Oracle" for product "Banking Supply Chain Finance"				14.2.0 Search vendor "Oracle" for product "Banking Supply Chain Finance" and version "14.2.0"		-		Affected
Oracle Search vendor "Oracle"		Banking Supply Chain Finance Search vendor "Oracle" for product "Banking Supply Chain Finance"				14.3.0 Search vendor "Oracle" for product "Banking Supply Chain Finance" and version "14.3.0"		-		Affected
Oracle Search vendor "Oracle"		Banking Supply Chain Finance Search vendor "Oracle" for product "Banking Supply Chain Finance"				14.5.0 Search vendor "Oracle" for product "Banking Supply Chain Finance" and version "14.5.0"		-		Affected
Oracle Search vendor "Oracle"		Blockchain Platform Search vendor "Oracle" for product "Blockchain Platform"				< 21.1.2 Search vendor "Oracle" for product "Blockchain Platform" and version " < 21.1.2"		-		Affected
Oracle Search vendor "Oracle"		Communications Calendar Server Search vendor "Oracle" for product "Communications Calendar Server"				8.0 Search vendor "Oracle" for product "Communications Calendar Server" and version "8.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Calendar Server Search vendor "Oracle" for product "Communications Calendar Server"				8.0.0.4.0 Search vendor "Oracle" for product "Communications Calendar Server" and version "8.0.0.4.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Contacts Server Search vendor "Oracle" for product "Communications Contacts Server"				8.0 Search vendor "Oracle" for product "Communications Contacts Server" and version "8.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Contacts Server Search vendor "Oracle" for product "Communications Contacts Server"				8.0.0.5.0 Search vendor "Oracle" for product "Communications Contacts Server" and version "8.0.0.5.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Diameter Signaling Router Search vendor "Oracle" for product "Communications Diameter Signaling Router"				>= 8.0.0 <= 8.2.2 Search vendor "Oracle" for product "Communications Diameter Signaling Router" and version " >= 8.0.0 <= 8.2.2"		-		Affected
Oracle Search vendor "Oracle"		Communications Element Manager Search vendor "Oracle" for product "Communications Element Manager"				>= 8.2.0 <= 8.2.4.0 Search vendor "Oracle" for product "Communications Element Manager" and version " >= 8.2.0 <= 8.2.4.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Instant Messaging Server Search vendor "Oracle" for product "Communications Instant Messaging Server"				10.0.1.5.0 Search vendor "Oracle" for product "Communications Instant Messaging Server" and version "10.0.1.5.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Messaging Server Search vendor "Oracle" for product "Communications Messaging Server"				8.1 Search vendor "Oracle" for product "Communications Messaging Server" and version "8.1"		-		Affected
Oracle Search vendor "Oracle"		Communications Offline Mediation Controller Search vendor "Oracle" for product "Communications Offline Mediation Controller"				12.0.0.3.0 Search vendor "Oracle" for product "Communications Offline Mediation Controller" and version "12.0.0.3.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Policy Management Search vendor "Oracle" for product "Communications Policy Management"				12.5.0 Search vendor "Oracle" for product "Communications Policy Management" and version "12.5.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Pricing Design Center Search vendor "Oracle" for product "Communications Pricing Design Center"				12.0.0.4.0 Search vendor "Oracle" for product "Communications Pricing Design Center" and version "12.0.0.4.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Services Gatekeeper Search vendor "Oracle" for product "Communications Services Gatekeeper"				7.0 Search vendor "Oracle" for product "Communications Services Gatekeeper" and version "7.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Session Report Manager Search vendor "Oracle" for product "Communications Session Report Manager"				>= 8.0.0.0 <= 8.2.2.1 Search vendor "Oracle" for product "Communications Session Report Manager" and version " >= 8.0.0.0 <= 8.2.2.1"		-		Affected
Oracle Search vendor "Oracle"		Communications Session Route Manager Search vendor "Oracle" for product "Communications Session Route Manager"				>= 8.2.0 <= 8.2.2.1 Search vendor "Oracle" for product "Communications Session Route Manager" and version " >= 8.2.0 <= 8.2.2.1"		-		Affected
Oracle Search vendor "Oracle"		Communications Unified Inventory Management Search vendor "Oracle" for product "Communications Unified Inventory Management"				7.4.1 Search vendor "Oracle" for product "Communications Unified Inventory Management" and version "7.4.1"		-		Affected
Oracle Search vendor "Oracle"		Identity Manager Connector Search vendor "Oracle" for product "Identity Manager Connector"				11.1.1.5.0 Search vendor "Oracle" for product "Identity Manager Connector" and version "11.1.1.5.0"		-		Affected
Oracle Search vendor "Oracle"		Siebel Core - Server Framework Search vendor "Oracle" for product "Siebel Core - Server Framework"				<= 21.5 Search vendor "Oracle" for product "Siebel Core - Server Framework" and version " <= 21.5"		-		Affected
Oracle Search vendor "Oracle"		Siebel Ui Framework Search vendor "Oracle" for product "Siebel Ui Framework"				<= 21.2 Search vendor "Oracle" for product "Siebel Ui Framework" and version " <= 21.2"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0"		-		Affected