CVE-2020-24750: debian debian_linux Deserialization of Untrusted Data

CVSS: 8.1v3.1HighModified

AliasesRHSA-2020:4173UBUNTU-CVE-2020-24750DEBIAN-CVE-2020-24750+152 more

Published 17-09-2020Last modified 08-10-2026

Vulnerability summary

CVE-2020-24750 is a high (CVSS 8.1) Deserialization of Untrusted Data vulnerability in debian debian_linux. EPSS estimates a 7.33% chance of exploitation in the next 30 days, higher than 94.3% of scored vulnerabilities.

Overall risk

34/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.1/10

010

High · v3.1 (NVD)

EPSS score

7.33%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1

DLA-2638-1

Timeline

17-09-2020
PublishedVulnerability first disclosed.
08-10-2026
Last modifiedVulnerability information updated.

Description

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.

CVSS metrics

7 scores · 6 sources · 2 versions

v3.18.1v2.06.8

EPSS trend

Probability

7.33%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

0.00 pp

From 7.33% on 18-09-2026

18-09-202618-10-2026

EPSS score

7.33%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected systems

Chainguard68 products

eco-java-gradle-2.10All versions (No fix recorded)
eco-java-gradle-2.11All versions (No fix recorded)
eco-java-gradle-2.12All versions (No fix recorded)
eco-java-gradle-2.13All versions (No fix recorded)
eco-java-gradle-2.14All versions (No fix recorded)

eco-java-gradle-2.14.1All versions (No fix recorded)
eco-java-gradle-2.4All versions (No fix recorded)
eco-java-gradle-2.5All versions (No fix recorded)
eco-java-gradle-2.6All versions (No fix recorded)
eco-java-gradle-2.7All versions (No fix recorded)
eco-java-gradle-2.8All versions (No fix recorded)
eco-java-gradle-2.9All versions (No fix recorded)
eco-java-gradle-3.0All versions (No fix recorded)
eco-java-gradle-3.1All versions (No fix recorded)
eco-java-gradle-3.2All versions (No fix recorded)
eco-java-gradle-3.2.1All versions (No fix recorded)
eco-java-gradle-3.3All versions (No fix recorded)
eco-java-gradle-3.4All versions (No fix recorded)
eco-java-gradle-3.4.1All versions (No fix recorded)
eco-java-gradle-3.5All versions (No fix recorded)
eco-java-gradle-3.5.1All versions (No fix recorded)
eco-java-gradle-4.0All versions (No fix recorded)
eco-java-gradle-4.0.1All versions (No fix recorded)
eco-java-gradle-4.0.2All versions (No fix recorded)
eco-java-gradle-4.1All versions (No fix recorded)
eco-java-gradle-4.10All versions (No fix recorded)
eco-java-gradle-4.10.1All versions (No fix recorded)
eco-java-gradle-4.10.2All versions (No fix recorded)
eco-java-gradle-4.10.3All versions (No fix recorded)
eco-java-gradle-4.2All versions (No fix recorded)
eco-java-gradle-4.2.1All versions (No fix recorded)
eco-java-gradle-4.3All versions (No fix recorded)
eco-java-gradle-4.3.1All versions (No fix recorded)
eco-java-gradle-4.4All versions (No fix recorded)
eco-java-gradle-4.4.1All versions (No fix recorded)
eco-java-gradle-4.5All versions (No fix recorded)
eco-java-gradle-4.5.1All versions (No fix recorded)
eco-java-gradle-4.6All versions (No fix recorded)
eco-java-gradle-4.7All versions (No fix recorded)
eco-java-gradle-4.8All versions (No fix recorded)
eco-java-gradle-4.8.1All versions (No fix recorded)
eco-java-gradle-4.9All versions (No fix recorded)
eco-java-gradle-5.0All versions (No fix recorded)
eco-java-gradle-5.1All versions (No fix recorded)
eco-java-gradle-5.1.1All versions (No fix recorded)
eco-java-gradle-5.2All versions (No fix recorded)
eco-java-gradle-5.2.1All versions (No fix recorded)
eco-java-gradle-5.3All versions (No fix recorded)
eco-java-gradle-5.3.1All versions (No fix recorded)
eco-java-gradle-5.4All versions (No fix recorded)
eco-java-gradle-5.4.1All versions (No fix recorded)
eco-java-gradle-5.5All versions (No fix recorded)
eco-java-gradle-5.5.1All versions (No fix recorded)
eco-java-gradle-5.6All versions (No fix recorded)
eco-java-gradle-5.6.1All versions (No fix recorded)
eco-java-gradle-5.6.2All versions (No fix recorded)
eco-java-gradle-5.6.3All versions (No fix recorded)
eco-java-gradle-5.6.4All versions (No fix recorded)
eco-java-gradle-6.0All versions (No fix recorded)
eco-java-gradle-6.0.1All versions (No fix recorded)
eco-java-gradle-6.1All versions (No fix recorded)
eco-java-gradle-6.1.1All versions (No fix recorded)
eco-java-gradle-6.2All versions (No fix recorded)
eco-java-gradle-6.2.1All versions (No fix recorded)
eco-java-gradle-6.2.2All versions (No fix recorded)
hadoop-fips-3.3.6All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5All versions (No fix recorded)

Show all 68

Oracle24 products

agile_product_lifecycle_management9.3.6
application_testing_suite13.3.0.1
autovue_for_agile_product_lifecycle_management21.0.2
banking_corporate_lending_process_management14.2.0 | 14.3.0 | 14.5.0
banking_credit_facilities_process_management14.2.0 | 14.3.0 | 14.5.0

Show all 24

Debian2 products

jackson-databind< 2.12.1-1
debian_linuxEOL9.0

Redhat2 products

rh-maven35-jackson-databind< 0:2.7.6-2.11.el7
rh-maven35-jackson-databind-javadoc< 0:2.7.6-2.11.el7

Com.fasterxml.jackson.core1 product

jackson-databind≥ 2.0, < 2.6.7.5 | ≥ 2.7.0, < 2.9.10.6

Fasterxml1 product

jackson-databind≥ 2.0.0, < 2.6.7.5 | ≥ 2.7.0, < 2.9.10.6

Ubuntu1 product

jackson-databindAll versions (No fix recorded)

7 vendors · 99 products

References

23 links

github.com/FasterXML/jackson-databind/issues/2798X Refsource MISCREPORTFIXWEBIssue TrackingPatchThird Party Advisory
www.oracle.com/security-alerts/cpujan2021.htmlX Refsource MISCAdvisoryWEBThird Party Advisory
github.com/FasterXML/jackson-databind/commit/ad5a630174f08d279504bc51ebba8772fd71b86bX Refsource CONFIRMFIXWEBPatchThird Party Advisory
security.netapp.com/advisory/ntap-20201009-0003/X Refsource CONFIRMAdvisoryThird Party Advisory
lists.debian.org/debian-lts-announce/2021/04/msg00025.htmlMailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory
www.oracle.com/security-alerts/cpuApr2021.htmlX Refsource MISCFIXWEBPatchThird Party Advisory
www.oracle.com//security-alerts/cpujul2021.htmlX Refsource MISCFIXWEBPatchThird Party Advisory
www.oracle.com/security-alerts/cpuoct2021.htmlX Refsource MISCFIXWEBPatchThird Party Advisory
www.oracle.com/security-alerts/cpujan2022.htmlX Refsource MISCFIXWEBPatchThird Party Advisory
www.oracle.com/security-alerts/cpuapr2022.htmlX Refsource MISCFIXWEBPatchThird Party Advisory

Show all 23 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities