An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• fasterxml jackson-databind2.0.0 and later · before 2.6.7.3
• fasterxml jackson-databind2.7.0 and later · before 2.7.9.4
• fasterxml jackson-databind2.8.0 and later · before 2.8.11.2
• fasterxml jackson-databind2.9.0 and later · before 2.9.6
• oracle clusterware12.1.0.2.0
• oracle communications instant messaging server10.0.1.2.0
• oracle global lifecycle management opatch13.9.4.0.0 and later · before 13.9.4.2.1
• oracle global lifecycle management opatchbefore 11.2.0.3.23
• oracle global lifecycle management opatch12.2.0.1.0 and later · before 12.2.0.1.19
• oracle retail customer management and segmentation foundation17.0
• oracle utilities advanced spatial and operational analytics2.7.0.1
• redhat openshift container platform3.11
• redhat openshift container platform4.1

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2017-17485FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix
  54Plan
• CVE-2017-7525A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthentica
  50Plan
• CVE-2020-8840FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyedi
  47Plan
• CVE-2020-9548FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.antero
  45Plan
• CVE-2020-9547FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sq
  45Plan
• CVE-2018-7489FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because
  45Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Data received over the network is deserialized into the language’s native object format without verifying its source. Code paths inside the object can be triggered during deserialization.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1payload = sock.recv(65536)2job = pickle.loads(payload)

1payload = sock.recv(65536)2if not hmac.compare_digest(sign(payload), header_sig):3    raise PermissionError("invalid signature")4job = JobSchema.validate(json.loads(payload))

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.