CVE-2020-10673

Aliases:GHSA-fqwf-pjwf-7vqvDEBIAN-CVE-2020-10673CGA-2pp6-rj82-38gwCGA-378w-4qqv-qff4CGA-3h82-xq37-qqpgCGA-3rqv-73xq-9rm7CGA-43hm-c94v-8r32CGA-43j7-vh8g-8jffCGA-4g5r-jgwm-hhpwCGA-4r78-jh4c-wxrmCGA-5444-3m3m-r985CGA-5w92-8mg8-5wmqCGA-6429-23p8-fhxpCGA-69wx-4f39-6pvxCGA-6cg2-6jg2-fj9cCGA-6mwr-xppq-gjjfCGA-823v-wg5g-r55vCGA-8rx5-82f2-jv2fCGA-95ph-252j-9qw6CGA-cmvg-wcj2-7rp8CGA-f2x6-rvw7-f47cCGA-f9vm-7xj5-mqvpCGA-g7hc-hx23-9r6jCGA-g987-2qg5-4fc8CGA-h5wq-3mmq-j7qmCGA-jxpp-j5pg-q4gqCGA-m6w2-pmc7-8m32CGA-mfgw-wfj4-gwc8CGA-mq3j-fj8w-crm3CGA-mvv9-2rv2-qxvrCGA-p693-496p-c287CGA-pgm4-fm9m-4339CGA-pv29-96rp-2529CGA-q7wc-qwr2-4xccCGA-qrm4-6xvg-hg5gCGA-qwhw-wvrc-3h57CGA-rr6q-5qgf-hvjjCGA-rvj5-8p33-c7qqCGA-rwxf-5643-94mmCGA-v545-pqrg-j22gCGA-v96v-wqrc-vcmwCGA-vq7w-mgwc-fhwpCGA-x74q-qjmp-m29cCGA-xqgx-xjp8-gp2cCGA-3qc9-8rc4-7x77CGA-44r2-hh97-fm59CGA-4fvc-m2xj-ff3qCGA-55hf-wjqg-c7r3CGA-648w-74q9-6wm8CGA-7hg2-p2pf-78r3CGA-8hgr-5hh9-g32cCGA-9237-85xm-g7cjCGA-92m7-5xpv-6jjmCGA-9g2f-h4c3-76r3CGA-cv9m-4hm7-qf7hCGA-f5hj-8g8h-3crwCGA-g8r7-jvrv-m7wqCGA-gwjf-3hm6-2rvfCGA-hcww-4hgj-5pqjCGA-m53w-x5rc-m6mhCGA-p2gj-mfwr-cxq2CGA-p85r-qcf8-2rf7CGA-p88c-hfr4-782xCGA-pcgm-534w-8459CGA-qcfj-xqpg-683qCGA-x6q2-5gjw-7xv9CGA-x7wg-6r2r-4qr6CGA-x9h4-mwpj-3gh4CGA-xp5r-vjff-h25vCGA-25w4-7g8p-h387CGA-25xr-8cwm-w7mjCGA-2mq6-9cqm-78hxCGA-3f9w-m8vh-39cvCGA-3gq6-w4pj-xj55CGA-457m-j58w-7vp6CGA-4cjr-pmjc-ghvhCGA-4wqv-3jgh-2j4fCGA-5m2j-389c-8x5xCGA-5p24-h5xc-jrprCGA-5vm7-9wmq-4hc8CGA-68mr-5wp7-8h3wCGA-6phj-h9hj-vqf2CGA-7gpv-53h5-75fjCGA-9c79-4p2q-4c34CGA-9j6p-9c42-43j8CGA-9wc2-236m-mh65CGA-c4v2-mqm5-gwffCGA-cffq-q623-jpfjCGA-f39p-hm6c-h3xxCGA-f4pq-288m-wf4xCGA-fhvf-8qwv-r78xCGA-fp7j-m3c4-69cwCGA-g6xv-wwj7-7vv9CGA-g722-r4v2-2mgcCGA-gmcv-p6hc-w27gCGA-gr76-wcgw-8cvcCGA-hjf7-xgxr-9grrCGA-hrvf-h4mv-3662CGA-jggw-xrg3-3qf9CGA-mwqh-4q8g-v54gCGA-p64m-f544-5cq3CGA-pwfq-pv5m-qpp4CGA-qhpm-6h4m-74pgCGA-r74j-pv3p-46hgCGA-rh7h-p3wg-3885CGA-v684-9jgc-5hp5CGA-w5qv-pj7x-v3c3CGA-whc2-xw6w-gwrfCGA-wqhw-6gv3-mj28CGA-x4gp-889j-pjjhCGA-xvw4-9wj4-rg42CGA-2fr2-p5p4-7g4xCGA-2gj5-7w75-7c8cCGA-55gr-6hx9-fm2hCGA-58w4-frwr-mhwjCGA-5jp6-7px6-w988CGA-5rmw-gf3p-fq2gCGA-5vm5-2r4c-p39vCGA-65c8-7c62-2mjfCGA-69w4-vxr5-f8gxCGA-7m5w-qhcf-jvxjCGA-7mm3-q478-p35jCGA-7qwx-3wjf-wqrfCGA-8786-mmmh-wf8fCGA-c299-3gjw-r855CGA-cp3j-7ppp-pf66CGA-cvpv-38q9-h79fCGA-fv3w-4fw9-8358CGA-fw2p-g5vf-rwrcCGA-h63c-rc69-9qw2CGA-j277-623q-x978CGA-jjr4-g4hf-h8g5CGA-jmwv-xmc9-p9wwCGA-m39j-qg42-rh48CGA-mw95-6423-2fmjCGA-pfcw-frrr-rp7mCGA-ph3x-5v59-6rrjCGA-qccc-q4qq-825hCGA-qjmr-p335-f577CGA-r8mg-2qwv-m3wcCGA-r9rx-pmq8-gfvmCGA-rpqw-wr64-g8x4CGA-v5h4-9gmg-2qpmCGA-vxxx-757q-m5qfCGA-w3jx-6rph-pj48CGA-w693-2fv7-p3gc
Advisory lineage Upstream: 0 Downstream: 13
Modified
Published: 18 Mar 2020, 21:17
Last modified:27 Aug 2025, 20:32

Vulnerability Summary

Overall Risk (default)
medium
37/100
CVSS Score
8.8 HIGH
v3.1 (cve.org)
EPSS Score
8.03% LOW
8% probability -12.44%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

18 Mar 2020, 21:17
Published
Vulnerability first disclosed
27 Aug 2025, 20:32
Last Modified
Vulnerability information updated

Description

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).

CVSS Metrics

  • v3.1•HIGH•Score: 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • v2.0•MEDIUM•Score: 6.8AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 8.03%• Percentile: 95%

Techniques & Countermeasures

  • CWE-502•Deserialization of Untrusted Data

    The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected Systems

  • chainguard•eco-java-gradle-2.10

    all

  • chainguard•eco-java-gradle-2.11

    all

  • chainguard•eco-java-gradle-2.12

    all

  • chainguard•eco-java-gradle-2.13

    all

  • chainguard•eco-java-gradle-2.14

    all

  • chainguard•eco-java-gradle-2.14.1

    all

  • chainguard•eco-java-gradle-2.4

    all

  • chainguard•eco-java-gradle-2.5

    all

  • chainguard•eco-java-gradle-2.6

    all

  • chainguard•eco-java-gradle-2.7

    all

  • chainguard•eco-java-gradle-2.8

    all

  • chainguard•eco-java-gradle-2.9

    all

  • chainguard•eco-java-gradle-3.0

    all

  • chainguard•eco-java-gradle-3.1

    all

  • chainguard•eco-java-gradle-3.2

    all

  • chainguard•eco-java-gradle-3.2.1

    all

  • chainguard•eco-java-gradle-3.3

    all

  • chainguard•eco-java-gradle-3.4

    all

  • chainguard•eco-java-gradle-3.4.1

    all

  • chainguard•eco-java-gradle-3.5

    all

  • chainguard•eco-java-gradle-3.5.1

    all

  • chainguard•eco-java-gradle-4.0

    all

  • chainguard•eco-java-gradle-4.0.1

    all

  • chainguard•eco-java-gradle-4.0.2

    all

  • chainguard•eco-java-gradle-4.1

    all

  • chainguard•eco-java-gradle-4.10

    all

  • chainguard•eco-java-gradle-4.10.1

    all

  • chainguard•eco-java-gradle-4.10.2

    all

  • chainguard•eco-java-gradle-4.10.3

    all

  • chainguard•eco-java-gradle-4.2

    all

  • chainguard•eco-java-gradle-4.2.1

    all

  • chainguard•eco-java-gradle-4.3

    all

  • chainguard•eco-java-gradle-4.3.1

    all

  • chainguard•eco-java-gradle-4.4

    all

  • chainguard•eco-java-gradle-4.4.1

    all

  • chainguard•eco-java-gradle-4.5

    all

  • chainguard•eco-java-gradle-4.5.1

    all

  • chainguard•eco-java-gradle-4.6

    all

  • chainguard•eco-java-gradle-4.7

    all

  • chainguard•eco-java-gradle-4.8

    all

  • chainguard•eco-java-gradle-4.8.1

    all

  • chainguard•eco-java-gradle-4.9

    all

  • chainguard•eco-java-gradle-5.0

    all

  • chainguard•eco-java-gradle-5.1

    all

  • chainguard•eco-java-gradle-5.1.1

    all

  • chainguard•eco-java-gradle-5.2

    all

  • chainguard•eco-java-gradle-5.2.1

    all

  • chainguard•eco-java-gradle-5.3

    all

  • chainguard•eco-java-gradle-5.3.1

    all

  • chainguard•eco-java-gradle-5.4

    all

Showing first 50 affected entries in server-rendered view.

References (14)