CVE-2020-35728: debian debian_linux Deserialization of Untrusted Data
CVSS: 8.1v3.1HighAnalyzed
AliasesUBUNTU-CVE-2020-35728DEBIAN-CVE-2020-35728CGA-29rm-764g-5p6hCGA-2cjq-6jc9-6q74CGA-2h3f-pxrm-r9g6CGA-2qc9-7ppg-877xCGA-2rhr-r77f-7h3jCGA-2v4j-r8j6-8j84CGA-374c-v45m-wf2vCGA-37h4-v5w5-qfmmCGA-38qp-v8c6-g2xrCGA-3cx7-g4m4-m3jcCGA-3fjf-rjhp-cj74CGA-3mhh-6739-63hqCGA-3rfc-xjmp-fp8xCGA-3wgf-5mjw-vw9rCGA-482f-hpxj-926cCGA-4ghm-8ggx-q3c6CGA-4jgp-4fgq-7h4wCGA-4wgw-8289-4m46CGA-4wq7-37qp-w5xqCGA-4xq5-hh85-cjchCGA-4xv9-7g37-p344CGA-5272-4ch3-wp36CGA-55f7-jjrg-h4rmCGA-55wv-2x34-hgpvCGA-5j7g-9xhh-2xxfCGA-5rjc-rw2v-vf73CGA-5rrj-r466-6jvpCGA-63jr-mv27-66xcCGA-67x5-q3wx-9v53CGA-6jg9-9m7x-jpmpCGA-6pwx-h22m-vcqpCGA-6wx4-cq43-p964CGA-729m-cw88-q7g6CGA-73mg-jw47-5mp4CGA-75jf-g29w-cwc9CGA-76f7-59hf-p4q7CGA-77v3-2gw9-jpx7CGA-7h8q-59wx-7cm9CGA-7px3-jpgw-pvwwCGA-7wg7-jg8m-v826CGA-8297-7fcm-4v26CGA-8756-98xv-9r3jCGA-8cc6-9qmw-5h3hCGA-8hmw-47fp-9jr6CGA-8xpm-9924-r7hwCGA-94x3-ppxj-hrcjCGA-974h-8rx3-2764CGA-98p5-vq33-mvg5CGA-998m-pj37-68q6CGA-99hm-4qhp-8gxjCGA-9fqw-4cgw-jphwCGA-9gr6-fv73-r967CGA-9jgh-75mc-jjxwCGA-9m7r-q4pp-p69mCGA-9rqh-m7rc-h2gjCGA-9xj6-jfgg-87v3CGA-c438-5fp7-6rqcCGA-c6cx-hgmg-52h7CGA-c97j-56jh-cxxmCGA-cq2g-57gc-pf26CGA-cwqw-rw22-8467CGA-f225-2fwq-8m56CGA-f2gc-mcrr-gprfCGA-f59x-93wq-wch6CGA-f8vj-cx5j-wp7wCGA-fcmq-5876-95gpCGA-fm9g-6pvj-rvcmCGA-fmv8-gvfp-63r8CGA-fmwq-4x2h-xvvwCGA-fp8m-xvwp-3pjpCGA-fq4m-prfq-gp35CGA-fqg7-rcg7-r8hxCGA-fxp3-vqw5-43g3CGA-g5g4-c6cp-56ppCGA-g7wq-82h3-mm6hCGA-g8p9-p6f9-jg84CGA-gch8-8f7f-x8p5CGA-gcv7-hm4r-6c57CGA-gfx4-hpjw-5gvxCGA-gjrm-cxh2-xfcxCGA-gjx6-v3h7-fmmpCGA-gmjp-qq95-69gqCGA-gqqq-j6pv-932gCGA-h44w-j75h-3fw9CGA-h7j7-hpcp-5vxrCGA-h86f-5j2p-xc78CGA-hfhp-wjhw-5xvxCGA-hp8v-4c4m-c4m2CGA-hw89-vhxq-277pCGA-j29f-3gqm-3x5gCGA-j4q8-5j25-3fcjCGA-j52q-8whf-jgpqCGA-jgjv-43rv-5fhfCGA-jjxc-5q4x-m77vCGA-jqfq-5w6g-jrhwCGA-jr65-8mh4-2vp9CGA-jwf8-pxxr-w2cwCGA-m54x-vjhp-c8g3CGA-m7g6-h6p9-q47qCGA-m949-p3r5-9j6pCGA-mhgm-rxff-7j5hCGA-mjfm-5p95-h895CGA-mm7j-xmc5-8pc4CGA-p23q-wrj7-cgp4CGA-p6v9-vg56-c6p8CGA-p773-wf8x-cxq2CGA-p7q5-hrv4-5rgcCGA-p8cq-7v68-6pq4CGA-p8hw-cr76-7635CGA-pf6f-vg8r-3wp2CGA-pm2h-w82v-79x8CGA-pr5g-r3qj-r5f7CGA-pvc5-vrjq-8qxxGHSA-5r5r-6hpj-8gg9CGA-pwr2-5wrr-w8xmCGA-pxrq-872f-gc62CGA-q3xv-gq6v-pjfpCGA-q5mp-hc3f-cv92CGA-q8hx-55f6-8mqrCGA-qcg9-42p5-cxm6CGA-qh25-chjw-jc5fCGA-qj2h-h4x5-vx94CGA-qw2g-f7j9-gx89CGA-rp3v-vcjf-9m74CGA-rqpf-987m-mrc6CGA-rvhp-x8pp-j83vCGA-rw44-jcfw-h4xwCGA-rwf4-493g-xpxjCGA-rwfg-42x6-hw4qCGA-rwjj-cw22-gxffCGA-v77h-v3r9-6rpwCGA-v79x-qwpq-9ghpCGA-vgmw-j7w4-4q4wCGA-vj2x-j9wv-r5rwCGA-vm55-q42q-6w4jCGA-vpcp-6q58-4rgcCGA-vq9j-p329-vqc5CGA-vv8f-qfmx-w9f4CGA-vv8j-cqrx-p3xxCGA-vvf2-x8m7-mff4CGA-vwx2-fp2h-x3p9CGA-w4x6-cwx2-3xgcCGA-w7mj-jrr4-7xwvCGA-w95g-7gx8-vqxmCGA-wfv4-vp37-j77rCGA-wj3x-v3hj-p3wcCGA-wp49-3qwc-4786CGA-wrgx-wx5r-gp2hCGA-wvw7-9j5j-jwp3CGA-wwmh-rgg4-qj5jCGA-xwww-7q45-ppjf
Published 27-12-2020Last modified 27-08-2025
Vulnerability summary
CVE-2020-35728 is a high (CVSS 8.1) Deserialization of Untrusted Data vulnerability in debian debian_linux. EPSS estimates a 12.50% chance of exploitation in the next 30 days, higher than 96.1% of scored vulnerabilities.
CVSS score
8.1/10
010
High · v3.1 (CVE.org)EPSS score
12.50%
0%100%
Medium · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 1Timeline
- 27-12-2020PublishedVulnerability first disclosed.
- 27-08-2025Last modifiedVulnerability information updated.
Description
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).
CVSS metrics
7 scores · 6 sources · 2 versionsHigh 8.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
12.50%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 12.50% on 18-09-2026
18-09-202618-10-2026
EPSS score12.50%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard68 products
- eco-java-gradle-2.10All versions (No fix recorded)
- eco-java-gradle-2.11All versions (No fix recorded)
- eco-java-gradle-2.12All versions (No fix recorded)
- eco-java-gradle-2.13All versions (No fix recorded)
- eco-java-gradle-2.14All versions (No fix recorded)
Oracle37 products
- agile_product_lifecycle_management9.3.6
- application_testing_suite13.3.0.1
- autovue21.0.2
- banking_corporate_lending_process_management14.2 | 14.3 | 14.5
- banking_credit_facilities_process_management14.2 | 14.3 | 14.5
Debian2 products
- jackson-databind< 2.12.1-1
- debian_linuxEOL9.0
Com.fasterxml.jackson.core1 product
- jackson-databind≥ 2.0.0, < 2.9.10.8
Fasterxml1 product
- jackson-databind≥ 2.0.0, < 2.6.7.5 | ≥ 2.7.0, < 2.9.10.8
Netapp1 product
Ubuntu1 product
- jackson-databindAll versions (No fix recorded)
7 vendors · 111 products
References
18 links- medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062X Refsource MISCAdvisoryThird Party Advisory
- github.com/FasterXML/jackson-databind/issues/2999X Refsource MISCREPORTFIXWEBPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2021/04/msg00025.htmlMailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory
