CVE-2020-24616: debian debian_linux Deserialization of Untrusted Data
CVSS: 8.1v3.1HighModified
AliasesUBUNTU-CVE-2020-24616DEBIAN-CVE-2020-24616CGA-227c-pm23-c998CGA-236v-r78f-5v2jCGA-2c2g-jc3w-m8r7CGA-2g6w-mxp2-gmj8CGA-2hh6-6446-9r57CGA-2q9m-4qvh-c8j3CGA-2rj8-4rg4-ch55CGA-2v7h-44q8-f27hCGA-36xf-3w97-vrpfCGA-385c-p9cx-gh95CGA-3cpm-h8qg-vmvxCGA-3h5c-7c5h-9x33CGA-3hj8-hw3x-9mxcCGA-3jhw-cv67-grrfCGA-3mcg-89wc-4fvwCGA-3rh4-cvpc-v2wjCGA-3vmq-9248-hgqfCGA-3xrm-jx48-rww5CGA-459r-xj3m-gx57CGA-4732-j64r-m2jfCGA-4764-455x-mv52CGA-4f5c-rp8f-wjmfCGA-4hh6-5mwh-9w3wCGA-4pw6-8vjw-c326CGA-52qh-fwhv-44c4CGA-59x3-54vw-9979CGA-5g5g-xf76-f4m8CGA-5h7f-v8q4-8wrjCGA-5pm4-8qpc-cx3xCGA-5q2w-98pq-wh24CGA-5qw9-pg9m-rc88CGA-5rpw-rqvr-fpmcCGA-5wvv-p48q-248qCGA-622j-c69f-p52jCGA-62jc-wx4h-g4mjCGA-63j9-6jpg-44gcCGA-6p2c-5976-72g2CGA-6r37-v2mv-c762CGA-78r2-gr2v-97jpCGA-793q-6j9r-3c73CGA-7965-q837-9mv2CGA-7gj6-hc4w-9597CGA-7gw2-xp7c-xp76CGA-7w7g-62q5-pcqcCGA-858c-w584-m698CGA-8cg7-p8h3-p53qCGA-8cv4-hpwm-q95xCGA-8fwg-8947-m8mcCGA-8m88-7c7m-7v9fCGA-8pxm-4c4j-76pgCGA-8rv9-p69h-gghgCGA-8vjc-54c3-6c8vCGA-8xp3-4wr4-639gCGA-94wq-r45q-hgh4CGA-9888-qwc9-wfgfCGA-99m4-5qvc-9fm8CGA-9c8g-rqfv-422qCGA-9g85-xx4p-v94vCGA-9gv9-52g5-9v5hCGA-9p45-2f3w-hpxcCGA-9w82-m986-hrhmCGA-cq77-hr53-wchmCGA-cq7x-j6hp-3h8xCGA-crwc-cq2f-gx3vCGA-f2c4-p579-c27rCGA-f3hj-8vp3-9fcmCGA-f4wc-qqrc-586pCGA-f56w-3vj2-vghjCGA-f5qg-gqrh-9gc5CGA-f622-84f6-rg4vCGA-f794-32rg-r3c2CGA-f959-4hxv-ffgrCGA-fm3w-2hm4-qw9cCGA-fmrg-vvvj-fvhmCGA-fpjj-8p5r-h3jhCGA-fq7h-2hrg-pfpvCGA-fwhv-rpg2-h49rCGA-fxg4-m946-ggfwCGA-g279-x9fg-72cgCGA-gchg-gwmr-r28rCGA-gcjf-p88x-pjfwCGA-gg49-v5j6-9w6hCGA-gj23-7xcp-2q5hCGA-gv2p-2qwf-6gqgCGA-gw3q-xrhw-9m33CGA-h3x2-gp7m-gx4fCGA-h68m-frqh-pvxjCGA-hj99-2gm7-f2fqCGA-hqpc-pcfj-6mfjCGA-hqpv-9pwg-g552CGA-hqqj-p8v5-59j9CGA-hx4r-4hhq-2jpmCGA-j8c9-vcv4-q2xmCGA-j8fr-42q9-fhm5CGA-j9j3-f44j-8gxxCGA-jgp5-cw7w-p7fcCGA-jw3r-c397-x32gCGA-jwv8-rp59-22mwCGA-jx8g-875v-5733CGA-jxxf-243x-rhg8CGA-m3c9-759q-vrfvCGA-m5hq-x958-w95mCGA-m7fp-2gr9-44crCGA-m7g5-xpg2-wg6gCGA-m7r9-8j93-3mr7CGA-mjv3-j5m2-w8h8CGA-mm27-mgj5-pqc7CGA-mp4f-2cx4-435gCGA-mxqp-qrvj-4vw2CGA-p3c3-872h-29pmCGA-pfmf-pqj7-474hCGA-phhf-7p7x-fh45CGA-pjvx-6rxv-hj4cCGA-pmcc-xqxv-47jpCGA-pp3c-gr26-mfc5CGA-pq36-cvcc-fmgxCGA-pr32-4c63-8349CGA-pr6f-h4pj-8f83CGA-pvf6-7j6f-7jf6GHSA-h3cw-g4mq-c5x2CGA-pxpf-j456-v6mpCGA-q8g4-cqx5-wfh5CGA-qg89-pc6q-mh3wCGA-qh9f-xmg7-qj78CGA-qhmp-7h9r-q8cjCGA-qm3x-xc2r-5v5xCGA-r4wx-w9ch-2jpgCGA-r6hg-h9c2-82f5CGA-rfvq-78fc-c973CGA-rhmq-pfqg-33vpCGA-rrh7-g47q-7jv4CGA-rx4c-84h8-3p9pCGA-rxf2-gm2x-52q7CGA-v3q3-5xjx-cghmCGA-v3rg-247v-83vgCGA-v4jv-82qc-42gmCGA-v8vj-424p-wx3gCGA-vfgx-jp97-5v38CGA-vw7f-3f87-3c94CGA-w2jf-p7r3-pqqhCGA-wcqc-hwrp-jxhpCGA-wgfc-rqf6-vhxrCGA-wj62-5wrq-6w8pCGA-wpqg-9x2g-p5fxCGA-ww68-vjpf-cfc5CGA-x3g7-74fj-pw27CGA-x3q9-3fhr-8hwgCGA-xmq9-62q4-mc2gCGA-xv6h-fr6x-4rc3CGA-xxjv-65jf-r446CGA-xxw3-w76m-rpwf
Published 25-08-2020Last modified 08-10-2026
Vulnerability summary
CVE-2020-24616 is a high (CVSS 8.1) Deserialization of Untrusted Data vulnerability in debian debian_linux. EPSS estimates a 7.61% chance of exploitation in the next 30 days, higher than 94.5% of scored vulnerabilities.
CVSS score
8.1/10
010
High · v3.1 (NVD)EPSS score
7.61%
0%100%
Low · -1.81 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 25-08-2020PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 8.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
7.61%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
-1.81 pp
From 9.42% on 19-09-2026
19-09-202619-10-2026
EPSS score7.61%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard68 products
- eco-java-gradle-2.10All versions (No fix recorded)
- eco-java-gradle-2.11All versions (No fix recorded)
- eco-java-gradle-2.12All versions (No fix recorded)
- eco-java-gradle-2.13All versions (No fix recorded)
- eco-java-gradle-2.14All versions (No fix recorded)
Oracle22 products
- agile_product_lifecycle_management9.3.6
- application_testing_suite13.3.0.1
- autovue_for_agile_product_lifecycle_management21.0.2
- banking_liquidity_management14.2 | 14.3 | 14.5
- banking_supply_chain_finance14.2 | 14.3 | 14.5
Debian2 products
- jackson-databind< 2.12.1-1
- debian_linuxEOL9.0
Com.fasterxml.jackson.core1 product
- jackson-databind≥ 2.0.0, < 2.9.10.6
Fasterxml1 product
- jackson-databind≥ 2.0.0, < 2.9.10.6
Netapp1 product
Ubuntu1 product
- jackson-databindAll versions (No fix recorded)
7 vendors · 96 products
References
18 links- github.com/FasterXML/jackson-databind/issues/2814X Refsource MISCFIXWEBIssue TrackingPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2021/04/msg00025.htmlMailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory
