CVE-2020-36179: debian debian_linux Deserialization of Untrusted Data

CVSS: 8.8v3.1HighModified

AliasesUBUNTU-CVE-2020-36179DEBIAN-CVE-2020-36179CGA-243v-mh7p-w7rc+150 more

Published 06-01-2021Last modified 04-08-2024

Vulnerability summary

CVE-2020-36179 is a high (CVSS 8.8) Deserialization of Untrusted Data vulnerability in debian debian_linux. EPSS estimates a 17.07% chance of exploitation in the next 30 days, higher than 97% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

49/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.8/10

010

High · v3.1 (CVE.org)

EPSS score

17.07%

0%100%

Medium · -3.95 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 1

DLA-2638-1

Timeline

06-01-2021
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.

CVSS metrics

7 scores · 6 sources · 2 versions

v3.18.8v2.06.8

EPSS trend

Probability

17.07%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

-3.95 pp

From 21.02% on 19-09-2026

19-09-202619-10-2026

EPSS score

17.07%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (cowtowncoder.medium.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected systems

Chainguard68 products

eco-java-gradle-2.10All versions (No fix recorded)
eco-java-gradle-2.11All versions (No fix recorded)
eco-java-gradle-2.12All versions (No fix recorded)
eco-java-gradle-2.13All versions (No fix recorded)
eco-java-gradle-2.14All versions (No fix recorded)

eco-java-gradle-2.14.1All versions (No fix recorded)
eco-java-gradle-2.4All versions (No fix recorded)
eco-java-gradle-2.5All versions (No fix recorded)
eco-java-gradle-2.6All versions (No fix recorded)
eco-java-gradle-2.7All versions (No fix recorded)
eco-java-gradle-2.8All versions (No fix recorded)
eco-java-gradle-2.9All versions (No fix recorded)
eco-java-gradle-3.0All versions (No fix recorded)
eco-java-gradle-3.1All versions (No fix recorded)
eco-java-gradle-3.2All versions (No fix recorded)
eco-java-gradle-3.2.1All versions (No fix recorded)
eco-java-gradle-3.3All versions (No fix recorded)
eco-java-gradle-3.4All versions (No fix recorded)
eco-java-gradle-3.4.1All versions (No fix recorded)
eco-java-gradle-3.5All versions (No fix recorded)
eco-java-gradle-3.5.1All versions (No fix recorded)
eco-java-gradle-4.0All versions (No fix recorded)
eco-java-gradle-4.0.1All versions (No fix recorded)
eco-java-gradle-4.0.2All versions (No fix recorded)
eco-java-gradle-4.1All versions (No fix recorded)
eco-java-gradle-4.10All versions (No fix recorded)
eco-java-gradle-4.10.1All versions (No fix recorded)
eco-java-gradle-4.10.2All versions (No fix recorded)
eco-java-gradle-4.10.3All versions (No fix recorded)
eco-java-gradle-4.2All versions (No fix recorded)
eco-java-gradle-4.2.1All versions (No fix recorded)
eco-java-gradle-4.3All versions (No fix recorded)
eco-java-gradle-4.3.1All versions (No fix recorded)
eco-java-gradle-4.4All versions (No fix recorded)
eco-java-gradle-4.4.1All versions (No fix recorded)
eco-java-gradle-4.5All versions (No fix recorded)
eco-java-gradle-4.5.1All versions (No fix recorded)
eco-java-gradle-4.6All versions (No fix recorded)
eco-java-gradle-4.7All versions (No fix recorded)
eco-java-gradle-4.8All versions (No fix recorded)
eco-java-gradle-4.8.1All versions (No fix recorded)
eco-java-gradle-4.9All versions (No fix recorded)
eco-java-gradle-5.0All versions (No fix recorded)
eco-java-gradle-5.1All versions (No fix recorded)
eco-java-gradle-5.1.1All versions (No fix recorded)
eco-java-gradle-5.2All versions (No fix recorded)
eco-java-gradle-5.2.1All versions (No fix recorded)
eco-java-gradle-5.3All versions (No fix recorded)
eco-java-gradle-5.3.1All versions (No fix recorded)
eco-java-gradle-5.4All versions (No fix recorded)
eco-java-gradle-5.4.1All versions (No fix recorded)
eco-java-gradle-5.5All versions (No fix recorded)
eco-java-gradle-5.5.1All versions (No fix recorded)
eco-java-gradle-5.6All versions (No fix recorded)
eco-java-gradle-5.6.1All versions (No fix recorded)
eco-java-gradle-5.6.2All versions (No fix recorded)
eco-java-gradle-5.6.3All versions (No fix recorded)
eco-java-gradle-5.6.4All versions (No fix recorded)
eco-java-gradle-6.0All versions (No fix recorded)
eco-java-gradle-6.0.1All versions (No fix recorded)
eco-java-gradle-6.1All versions (No fix recorded)
eco-java-gradle-6.1.1All versions (No fix recorded)
eco-java-gradle-6.2All versions (No fix recorded)
eco-java-gradle-6.2.1All versions (No fix recorded)
eco-java-gradle-6.2.2All versions (No fix recorded)
hadoop-fips-3.3.6All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5All versions (No fix recorded)

Show all 68

Oracle39 products

agile_product_lifecycle_management9.3.6
application_testing_suite13.3.0.1
autovue_for_agile_product_lifecycle_management21.0.2
banking_corporate_lending_process_management14.2 | 14.3 | 14.5
banking_credit_facilities_process_management14.2 | 14.3 | 14.5

Show all 39

Debian2 products

jackson-databind< 2.12.1-1
debian_linuxEOL9.0

Netapp2 products

Com.fasterxml.jackson.core1 product

jackson-databind≥ 2.7.0, < 2.9.10.8 | ≥ 2.0.0, < 2.6.7.5

Fasterxml1 product

jackson-databind≥ 2.0.0, < 2.6.7.5 | ≥ 2.7.0, < 2.9.10.8

Ubuntu1 product

jackson-databindAll versions (No fix recorded)

7 vendors · 114 products

References

19 links

cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062X Refsource MISCREPORTEVIDENCEWEBExploitTechnical DescriptionThird Party Advisory
github.com/FasterXML/jackson-databind/issues/3004X Refsource MISCREPORTFIXWEBIssue TrackingPatchThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.debian.org/debian-lts-announce/2021/04/msg00025.htmlMailing ListX Refsource MLISTAdvisoryWEBMitigationThird Party Advisory
www.oracle.com/security-alerts/cpuApr2021.htmlX Refsource MISCAdvisoryWEBThird Party Advisory
security.netapp.com/advisory/ntap-20210205-0005/X Refsource CONFIRMAdvisoryThird Party Advisory
www.oracle.com//security-alerts/cpujul2021.htmlX Refsource MISCFIXWEBPatchThird Party Advisory
www.oracle.com/security-alerts/cpuoct2021.htmlX Refsource MISCFIXWEBPatchThird Party Advisory
www.oracle.com/security-alerts/cpujan2022.htmlX Refsource MISCFIXWEBPatchThird Party Advisory
www.oracle.com/security-alerts/cpuapr2022.htmlX Refsource MISCFIXWEBPatchThird Party Advisory

Show all 19 references

www.oracle.com/security-alerts/cpujul2022.htmlX Refsource MISCAdvisoryWEBThird Party Advisory
ubuntu.com/security/CVE-2020-36179REPORT
www.cve.org/CVERecord?id=CVE-2020-36179REPORT
security-tracker.debian.org/tracker/CVE-2020-36179Advisory
nvd.nist.gov/vuln/detail/CVE-2020-36179Advisory
github.com/FasterXML/jackson-databind/commit/3ded28aece694d0df39c9f0fa1ff385b14a8656bWEB
github.com/FasterXML/jackson-databindPACKAGE
lists.apache.org/thread.html/…WEB
security.netapp.com/advisory/ntap-20210205-0005WEB

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities