CVE-2020-36184: debian debian_linux Deserialization of Untrusted Data
CVSS: 8.8v3.1HighModified
AliasesUBUNTU-CVE-2020-36184DEBIAN-CVE-2020-36184CGA-28xr-2pv8-gprjCGA-2fgj-h343-x6rqCGA-2pjp-h3p8-q5j6CGA-2r59-wc39-89xxCGA-2vv3-mwgw-9j28CGA-32c5-g544-c5rwCGA-354j-mv2h-x58rCGA-39pv-37fx-chcpCGA-39rq-2c22-65hmCGA-3c28-r698-qgh8CGA-3jr8-58qq-c6qgCGA-4438-w8m9-px83CGA-46rq-r3cf-7frhCGA-4fj7-wgjp-phwjCGA-4gv2-mhxq-j74mCGA-4gv9-94mm-mwvhCGA-4v62-xrm2-8cjmCGA-4wcw-p5r8-8jhfCGA-4x8m-pvhr-px32CGA-522v-794m-6m74CGA-5246-354v-pfcwCGA-5g26-j733-qmh2CGA-5h5h-6x99-xjmxCGA-5j2j-vp5f-cw4qCGA-5p64-m526-r5c5CGA-5qp9-vcf3-vrfjCGA-5wfg-wghh-mhhwCGA-62xv-wm52-4pw8CGA-6h69-xf8j-mxf8CGA-6m56-7c3w-x4cjCGA-6vv5-753h-mhpcCGA-6wfq-vqqv-4phhCGA-7262-c8c3-x63hCGA-727r-92ch-p26vCGA-74hw-jm6j-p2mxCGA-7g5j-m38m-3c7cCGA-7hj7-f376-m2j9CGA-7jj7-m5xg-574jCGA-7mj8-x33v-v2m2CGA-7mvf-hjvw-24qmCGA-7q6w-qx48-5r6rCGA-7x92-xh73-v67wCGA-7xv6-949q-9fqqCGA-85mq-p3xv-gwr8CGA-872v-jmr9-wq2qCGA-89pv-jp55-mmm6CGA-8f72-gj4c-w88vCGA-8g9v-5q8c-vgh6CGA-8gxg-23h9-7ggcCGA-8h7p-cv5c-3297CGA-8p59-59r3-v7jcCGA-96vj-prgr-v7rcCGA-99rv-v72j-87p9CGA-9ffw-g9c4-hr68CGA-9jr4-684x-gh4rCGA-9r27-2fcf-3pmrCGA-9v44-gmfq-g593CGA-9x2c-27q7-whf5CGA-c3rg-gpwc-xqqmCGA-cjfx-46vf-x88fCGA-ff6m-f628-478mCGA-fgfj-hw3h-ph23CGA-fmqj-r337-fp98CGA-frw4-j3w3-gcc2CGA-g6w2-37gf-rh4fCGA-g838-xqjq-mqc6CGA-ggj5-4g9x-8pvcCGA-ggx3-pq9f-w8rjCGA-gj52-pcmg-m3gvCGA-gm9v-55hq-h929CGA-gr3c-3p34-mvmcCGA-gxvf-xhf6-wvjxCGA-h3mx-w6qf-jx62CGA-h7w8-gpj6-5mx9CGA-h7xm-9r7v-jghmCGA-hg8h-mwhv-4g2pCGA-hjvr-648r-f46vCGA-hpj5-97fv-wp3hCGA-hww6-xxxp-w837CGA-hxf7-85pc-cfj5CGA-j347-jhjf-prmqCGA-j676-3c8c-89m6CGA-j69c-8j99-qf2wCGA-j897-6353-3jc2CGA-j8gf-7829-79gqCGA-j8h7-4j33-252cCGA-jhx4-p799-c956CGA-jjwh-fcxx-5vprCGA-jm45-8pwx-fp54CGA-jmq2-54fm-jmffCGA-jw23-j9qg-w6wjCGA-jw6c-76hj-5g7mCGA-m5xc-c6fj-jc29CGA-m9r3-3p57-wx44CGA-mfjq-xq7c-2677CGA-mfqg-847h-wr43CGA-mmjr-9mpm-5fchCGA-mwc6-vm8r-x9vwCGA-mx26-6354-72w4CGA-p268-9p97-9mpwCGA-p2h7-q97j-xxwfCGA-p3q5-x9fh-2m67CGA-p4cf-5j2r-442vCGA-p55m-pvxx-829vCGA-p7mg-87fj-cwvgCGA-pfrv-8wg3-jjw2CGA-pgrq-4w6v-ww99CGA-pgx7-6h57-4p4xCGA-pr4c-p8rc-4gwrGHSA-m6x4-97wx-4q27CGA-q26v-vq5w-76f3CGA-q323-8m25-cjhhCGA-q334-pr94-8jphCGA-q49m-v862-c37hCGA-q6rf-wc4j-x938CGA-qcc6-h782-wxg4CGA-qhhc-m232-9jc4CGA-qjv4-87m9-jrj2CGA-qr32-x4hp-xfmjCGA-qw59-3xqx-mq67CGA-r3r9-4gr3-vrhqCGA-r5g5-26xw-ch6rCGA-r7r5-x8q7-j5g8CGA-r8cq-5w9c-fjc4CGA-rc4m-26hc-c23hCGA-rh7h-9q89-r869CGA-rj5j-4262-8676CGA-rjhv-m3pf-g8rfCGA-rp94-8gjv-3r5mCGA-rqq6-532m-f455CGA-rrgv-wv6x-mhmgCGA-rvm6-2hgh-qvg6CGA-rwmc-wrwp-8xggCGA-rww9-9jq8-xpvcCGA-v6vf-9vr6-cfh4CGA-v76p-98qw-65r6CGA-v8xv-cvch-w4w9CGA-vcq7-x87c-948rCGA-vm4f-j3xx-jfxhCGA-vmx2-48hj-xjr4CGA-vrgc-73cr-4hx5CGA-w5h9-2585-v6gmCGA-w5r8-3cj9-45v4CGA-w75f-7r4f-h378CGA-wh8h-57m2-445hCGA-wjhp-chx7-q7rjCGA-wx53-87g5-cf8cCGA-x6f6-c2r4-wpjfCGA-x6mr-62p5-qgp8CGA-xcq8-cv43-43h6CGA-xh5g-xh44-43h6
Published 06-01-2021Last modified 04-08-2024
Vulnerability summary
CVE-2020-36184 is a high (CVSS 8.8) Deserialization of Untrusted Data vulnerability in debian debian_linux. EPSS estimates a 8.29% chance of exploitation in the next 30 days, higher than 94.8% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.8/10
010
High · v3.1 (CVE.org)EPSS score
8.29%
0%100%
Low · -2.09 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 06-01-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.
CVSS metrics
7 scores · 6 sources · 2 versionsHigh 8.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSources6 sources · 8.1–8.8
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · ChainguardEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · MavenEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
8.29%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
-2.09 pp
From 10.38% on 18-09-2026
18-09-202618-10-2026
EPSS score8.29%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (cowtowncoder.medium.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard68 products
- eco-java-gradle-2.10All versions (No fix recorded)
- eco-java-gradle-2.11All versions (No fix recorded)
- eco-java-gradle-2.12All versions (No fix recorded)
- eco-java-gradle-2.13All versions (No fix recorded)
- eco-java-gradle-2.14All versions (No fix recorded)
Oracle41 products
- agile_product_lifecycle_management9.3.6
- application_testing_suite13.3.0.1
- autovue_for_agile_product_lifecycle_management21.0.2
- banking_corporate_lending_process_management14.2 | 14.3 | 14.5
- banking_credit_facilities_process_management14.2 | 14.3 | 14.5
Debian2 products
- jackson-databind< 2.12.1-1
- debian_linuxEOL9.0
Netapp2 products
Com.fasterxml.jackson.core1 product
- jackson-databind≥ 2.0.0, < 2.9.10.8
Fasterxml1 product
- jackson-databind≥ 2.0.0, < 2.6.7.5 | ≥ 2.7.0, < 2.9.10.8
Ubuntu1 product
- jackson-databindAll versions (No fix recorded)
7 vendors · 116 products
References
17 links- cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062X Refsource MISCREPORTEVIDENCEWEBExploitTechnical DescriptionThird Party Advisory
- github.com/FasterXML/jackson-databind/issues/2998X Refsource MISCREPORTFIXWEBIssue TrackingPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2021/04/msg00025.htmlMailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory
