CVE-2020-36185: debian debian_linux Deserialization of Untrusted Data
CVSS: 8.1v3.1HighModified
AliasesUBUNTU-CVE-2020-36185DEBIAN-CVE-2020-36185CGA-227g-j837-gcx5CGA-22fc-6c7v-r22fCGA-23vh-58h3-39gjCGA-27gj-fcpx-87cgCGA-28h4-993j-982rCGA-2h3p-jm9v-267pCGA-2h87-4wg3-3cgjCGA-2hq7-f46q-wh2pCGA-2jq2-m5fg-54vcCGA-2jwq-qwpm-ghmxCGA-3c63-cqpf-5mm2CGA-3h73-ch2x-x9p3CGA-3jq4-95q5-gf55CGA-3p7m-8674-cpcrCGA-3qvq-xc6f-w785CGA-3rj6-46mr-rwmxCGA-3wqm-xj24-8964CGA-3xm2-pwmc-2vpxCGA-43w2-f23h-xq9rCGA-47j9-w365-q839CGA-49hw-v426-rc7jCGA-4p7c-q3j3-2w6xCGA-4x65-fx9h-99pgCGA-58pr-rgvq-f8whCGA-5h75-p3j5-qpq4CGA-5mw2-w6cg-fqfjCGA-5v33-8927-chc2CGA-5wq3-3p5h-mv92CGA-65cq-4m45-pc49CGA-6p5m-4vjj-w9jxCGA-6rvw-hf8f-w7qqCGA-6w59-g7pj-c4hxCGA-725m-wh47-hr9fCGA-7h45-x9gg-95v9CGA-7h62-9g6c-38jhCGA-7mf5-rj2m-44jqCGA-84mh-ggx3-38w9CGA-8cv2-p6jw-337jCGA-8j49-83w5-c6mvCGA-8j76-w5m2-8gppCGA-8r69-r63f-p6v8CGA-8xfw-p9w9-wh95CGA-92p3-6r76-38pvCGA-939g-j345-f4hcCGA-944r-pj6v-c8hrCGA-96mh-h67h-373jCGA-9gq5-2pwf-64r3CGA-9m6w-43h8-87vcCGA-c2cj-f48h-g8q9CGA-c6jg-7fq9-vwfvCGA-c7gc-chgg-m8cxCGA-c7rr-46j7-3738CGA-cfvm-8jhx-375rCGA-cj2q-fmj6-5679CGA-cjcx-m897-3rvmCGA-cr44-xhjg-rjq2CGA-cvhq-665v-4fqmCGA-cx8x-c84x-3xrfCGA-f2hq-7vj6-hq3mCGA-f6qc-28gr-4h4qCGA-fc3r-482f-gmf3CGA-ff72-qpgf-4x7gCGA-fhf5-664g-58xmCGA-fhg2-w3mc-4qm8CGA-fwj8-gxgq-grg7CGA-fx4c-886p-vhq7CGA-g276-crm5-f2rvCGA-g39h-hgvw-qww7CGA-g3x8-685x-9ph8CGA-g5m8-rp9c-jqxpCGA-g5q8-7xp5-qgjcCGA-g5rm-pghf-xm3qCGA-ghxg-cg86-qgh3CGA-gqqg-9q9h-g825CGA-gr2r-x379-w55mCGA-h3ff-fmhg-q2jrCGA-h46w-45q8-jxh2CGA-h5pv-6qc5-6hqpCGA-h64j-q94p-qp8gCGA-hgfx-gp6p-rcjmCGA-hj34-m8v7-cxxrCGA-hp7q-jj2c-452pCGA-hrcv-5cxm-x97wCGA-hrp3-g7hj-mf59CGA-hvpq-556x-g6h5CGA-hw6h-wgw9-m6jhCGA-hwfj-wmj2-f2jpCGA-hx45-6633-mpm8CGA-hxq9-253v-58x4CGA-j399-hxgr-97h8CGA-jcjq-jwph-6gr2CGA-jcwp-435q-w4p5CGA-jf59-9cgw-85cvCGA-jpwg-x85h-v6fpCGA-jw94-mmpq-pj7qCGA-m36x-vmmf-rpgfCGA-m3mj-pj7h-q2q2CGA-m6pv-4ff6-ccw6CGA-mc86-4vxg-4fmxCGA-mh9r-m7pm-5xxmCGA-mmxv-q89c-gh65CGA-p66w-r7pw-wfwvCGA-pfxx-v6x2-hh5xCGA-ph5v-rmq8-79mwCGA-pm33-mpj8-mmxmCGA-pp5m-rr2h-299rGHSA-8w26-6f25-cm9xCGA-px76-3mr5-qp93CGA-q4pg-3mpr-ghmpCGA-q6p4-gj4h-j4pfCGA-q9wq-2638-8p9jCGA-qchr-mh43-97f2CGA-qh95-fq2g-xhrmCGA-qj2p-57cx-w96vCGA-qmq3-r929-9cqcCGA-qrhg-p252-8fm2CGA-r3mm-hqjg-4qgrCGA-r4rj-2q2w-45q2CGA-r522-qpgh-2qxxCGA-rq8f-vpq7-m6rxCGA-rr48-6g6r-fm98CGA-rv7j-cx7v-69pcCGA-rwxg-xhfv-74wxCGA-rxj9-883v-xwxwCGA-rxx8-3crj-m7rhCGA-v9xj-7848-5pw9CGA-vffr-wf6g-h679CGA-vjpj-2px8-qvjgCGA-vm8x-7r36-r43fCGA-vpcj-w984-gf93CGA-vrm2-mrh8-g3f6CGA-w32q-3559-v4frCGA-w69x-v8qc-fmg2CGA-wjhm-rpgm-c2cqCGA-wqmg-26xx-5v9jCGA-wqq7-5xpx-6wjqCGA-wr89-v24r-4387CGA-wv8x-r7f9-2gcgCGA-wwwm-2jwq-wx6rCGA-wxxr-q9jv-v9x7CGA-x3gm-jh4g-j6mhCGA-x5j6-5827-8rvqCGA-x6fh-q4xh-2h5gCGA-x796-pf66-jv5jCGA-x7wg-487c-8664CGA-x82q-2qr3-vq3jCGA-xf28-63x2-3pw4CGA-xgf3-wm2r-267vCGA-xj93-f97h-88q7CGA-xjwg-x9r8-f2cmCGA-xp3w-9rpc-j762
Published 06-01-2021Last modified 08-10-2026
Vulnerability summary
CVE-2020-36185 is a high (CVSS 8.1) Deserialization of Untrusted Data vulnerability in debian debian_linux. EPSS estimates a 4.24% chance of exploitation in the next 30 days, higher than 90.9% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.1/10
010
High · v3.1 (NVD)EPSS score
4.24%
0%100%
Low · -0.98 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 06-01-2021PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 8.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
4.24%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
-0.98 pp
From 5.22% on 18-09-2026
18-09-202618-10-2026
EPSS score4.24%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (cowtowncoder.medium.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard68 products
- eco-java-gradle-2.10All versions (No fix recorded)
- eco-java-gradle-2.11All versions (No fix recorded)
- eco-java-gradle-2.12All versions (No fix recorded)
- eco-java-gradle-2.13All versions (No fix recorded)
- eco-java-gradle-2.14All versions (No fix recorded)
Oracle41 products
- agile_product_lifecycle_management9.3.6
- application_testing_suite13.3.0.1
- autovue_for_agile_product_lifecycle_management21.0.2
- banking_corporate_lending_process_management14.2 | 14.3 | 14.5
- banking_credit_facilities_process_management14.2 | 14.3 | 14.5
Debian2 products
- jackson-databind< 2.12.1-1
- debian_linuxEOL9.0
Netapp2 products
Com.fasterxml.jackson.core1 product
- jackson-databind≥ 2.0.0, < 2.9.10.8
Fasterxml1 product
- jackson-databind≥ 2.0.0, < 2.6.7.5 | ≥ 2.7.0, < 2.9.10.8
Ubuntu1 product
- jackson-databindAll versions (No fix recorded)
7 vendors · 116 products
References
17 links- cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062X Refsource MISCREPORTEVIDENCEWEBExploitTechnical DescriptionThird Party Advisory
- github.com/FasterXML/jackson-databind/issues/2998X Refsource MISCREPORTFIXWEBIssue TrackingPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2021/04/msg00025.htmlMailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory
