CVE-2020-35490: debian debian_linux Deserialization of Untrusted Data
CVSS: 8.1v3.1HighModified
AliasesUBUNTU-CVE-2020-35490DEBIAN-CVE-2020-35490CGA-25vp-rjrg-cr82CGA-278j-ffrc-67f6CGA-286c-f2cc-9pq9CGA-2hfr-4w69-jrq8CGA-2jm6-4q6x-9hqfCGA-2m77-8rr5-r78hCGA-3374-4j5q-8ch7CGA-34qx-h78r-4c2rCGA-39cp-c8r4-j8jjCGA-3cwj-mm7h-rx5cCGA-3f4c-gc4m-594pCGA-3gcr-w9j5-8xr6CGA-3hm4-qrvj-3mmpCGA-3j5c-756f-4cvxCGA-3r44-5w84-rr23CGA-46j5-q59h-jrqqCGA-479j-jjvw-qgx9CGA-4fg5-p5j6-j85jCGA-4pr3-6r5p-gx7hCGA-4r6p-4gf3-xj22CGA-59v2-6r7v-c4m9CGA-5j6g-f5cp-mp76CGA-5mxj-r4q2-cqj3CGA-5p5p-564m-v2wmCGA-5q8f-j3x5-8x4fCGA-5vqq-q9mj-8499CGA-5wff-8x7v-43rpCGA-5x4j-jf7x-5f4mCGA-6355-pw67-pqv9CGA-69rw-jjrq-m995CGA-6c5q-q3vv-94cwCGA-6hw7-2wf3-v584CGA-6jvv-mpmc-35fcCGA-6pp9-v7mw-2c6rCGA-73j7-hg89-254hCGA-73rv-xg89-374cCGA-7496-66g8-5qj6CGA-765m-72h8-w9cqCGA-77m2-qvrp-4934CGA-79j4-8prw-gm96CGA-7g52-5pc4-rh83CGA-7hcf-pc3v-837xCGA-7hjx-q6mc-g347CGA-7m6c-366v-7m24CGA-7qgq-5cxp-6mfcCGA-7v85-554f-467pCGA-83hf-7pp4-756mCGA-8h58-5f63-f25xCGA-8m34-ghf9-fxh8CGA-8wrf-693v-56h2CGA-8xj9-mm3p-vjpfCGA-93f7-jpmf-qpx9CGA-947v-63w3-4m58CGA-94g9-v8x6-p6fjCGA-9858-g93h-fjfpCGA-99vh-59xm-4cj5CGA-9hp8-22jx-39xgCGA-9jcr-j297-p47rCGA-9qhw-c7ff-24fjCGA-9r87-37ww-2gc6CGA-c27p-94gj-cxw4CGA-c37x-jjp6-2478CGA-c48x-p7gg-6wq3CGA-c4qx-4p7p-x5v4CGA-c7wm-jqhp-jcgcCGA-cmp3-v6w6-3p76CGA-cq6m-jpx3-p3c3CGA-f6gx-4254-7f37CGA-f9pq-w3pp-wfqxCGA-fhr9-6p9x-mx57CGA-fm8v-wp4x-3hqgCGA-fppx-q55v-rmhpCGA-fqp2-j5fm-h59jCGA-fr4m-vhhc-jwcfCGA-fv5g-x3w9-5w32CGA-fw7x-46mq-3rqfCGA-g3hr-gcwx-m44wCGA-g636-2xc8-9mw4CGA-g66p-cgvf-97f3CGA-gh94-8wx8-x9vxCGA-gqh6-76mf-2r66CGA-h2m4-pggg-x64gCGA-h37g-j5fr-6fgpCGA-h4wg-3hvr-77jmCGA-h697-g8c6-99q8CGA-h6xw-cm5q-mvq5CGA-h883-h275-j267CGA-hf94-qv27-4f72CGA-hgr5-pjx8-jmv4CGA-hh2w-3w22-r5frCGA-hqpv-hxpj-22f9CGA-jf99-gv8m-5x6xCGA-jm7m-35vm-w6jpCGA-m655-x2h4-2527CGA-m7jf-7pr8-8gcvCGA-m89q-vw9m-7hpcCGA-mcgv-cggm-q3prCGA-mm63-87rp-jx52CGA-mmpx-cxq7-2gjfCGA-mpp9-mx5r-pgmhCGA-mpqv-564r-3jg9CGA-mrq8-3q2c-6pmcCGA-mvv7-rgfv-c33wCGA-mwww-x4f3-6mh4CGA-mx4q-4wj6-9663CGA-pfc4-9cmj-6h6hCGA-pggx-f35h-mhvgCGA-pgm4-q6w2-hr4gCGA-pvq7-xqx4-vq4pGHSA-wh8g-3j2c-rqj5CGA-pwp8-74cx-6w96CGA-q454-r398-9q6rCGA-q4g9-p2v7-rq6rCGA-q8fx-m95v-fw5rCGA-qqp6-vrhm-qg36CGA-qw2j-r6c4-frhrCGA-r2wj-47vm-8h33CGA-r3qg-wrv5-7mrrCGA-r9w5-xw29-wmmxCGA-rcv5-fr46-ggvqCGA-rm2c-pfx6-3j2hCGA-rpv2-f6x3-f38mCGA-rrmc-44rx-357wCGA-rx8x-7hq2-4m87CGA-rxpf-pjwq-9h6jCGA-v569-5wq2-xwj2CGA-v8vh-3jg5-397jCGA-vc3w-g4hm-g6h7CGA-vf5x-mprg-jffmCGA-vgr9-ph8q-3744CGA-vj28-w598-fj5gCGA-vx25-2pxj-gcg6CGA-w5gf-2j32-gj23CGA-w632-jqwg-7mxjCGA-wgxm-q26g-qgqwCGA-wpfh-289r-x3xpCGA-wvg2-mr5j-fm6pCGA-ww9x-8x63-vrhjCGA-wx54-j25x-5qfgCGA-x2gh-xvp5-hx2cCGA-x48c-3ghw-fqg8CGA-x4mx-h843-45vqCGA-x958-r4fw-mxjhCGA-x977-mwr5-hq52CGA-x9j6-3r4j-j7x8CGA-xc2v-rghw-qmc3CGA-xhv8-9j39-86r7CGA-xjmj-4r7h-rqqxCGA-xph5-38j5-3q93CGA-xvp6-7qmc-6rgxCGA-xwcc-rmc5-xw79CGA-xx9f-5j9g-5c44
Published 17-12-2020Last modified 08-10-2026
Vulnerability summary
CVE-2020-35490 is a high (CVSS 8.1) Deserialization of Untrusted Data vulnerability in debian debian_linux. EPSS estimates a 6.29% chance of exploitation in the next 30 days, higher than 93.5% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.1/10
010
High · v3.1 (NVD)EPSS score
6.29%
0%100%
Low · -1.54 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 17-12-2020PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 8.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
6.29%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
-1.54 pp
From 7.82% on 18-09-2026
18-09-202618-10-2026
EPSS score6.29%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (cowtowncoder.medium.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard68 products
- eco-java-gradle-2.10All versions (No fix recorded)
- eco-java-gradle-2.11All versions (No fix recorded)
- eco-java-gradle-2.12All versions (No fix recorded)
- eco-java-gradle-2.13All versions (No fix recorded)
- eco-java-gradle-2.14All versions (No fix recorded)
Oracle22 products
- agile_product_lifecycle_management9.3.6
- application_testing_suite13.3.0.1
- autovue_for_agile_product_lifecycle_management21.0.2
- banking_platform2.6.2 | 2.7.0 | 2.7.1 | 2.8.0 | 2.9.0 | 2.10.0
- banking_treasury_management14.4
Debian2 products
- jackson-databind< 2.12.1-1
- debian_linuxEOL9.0
Com.fasterxml.jackson.core1 product
- jackson-databind≥ 2.0.0, < 2.9.10.8
Fasterxml1 product
- jackson-databind≥ 2.0.0, < 2.9.10.8
Netapp1 product
Ubuntu1 product
- jackson-databindAll versions (No fix recorded)
7 vendors · 96 products
References
17 links- cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062X Refsource MISCREPORTEVIDENCEWEBExploitTechnical DescriptionThird Party Advisory
- github.com/FasterXML/jackson-databind/issues/2986X Refsource MISCREPORTAdvisoryWEBThird Party Advisory
lists.debian.org/debian-lts-announce/2021/04/msg00025.htmlMailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory
