CVE-2020-36189: debian debian_linux Deserialization of Untrusted Data
CVSS: 8.1v3.1HighModified
AliasesUBUNTU-CVE-2020-36189DEBIAN-CVE-2020-36189CGA-22m2-4584-mr46CGA-23q2-59rq-cvxvCGA-24mp-8jgw-6342CGA-26xf-j699-85m6CGA-27fr-gqwv-cgq8CGA-2cvj-f76c-5m27CGA-2fwh-8h39-xj9jCGA-2gm3-xvqr-3c2xCGA-2jc7-94j5-qm59CGA-2pq6-rh6m-8p9xCGA-2v37-46c8-m4r9CGA-3cqq-w27w-fp52CGA-3fpg-ww29-r6wmCGA-3j4x-q4xf-x4p7CGA-3jfh-785m-96g3CGA-3pvg-95q5-7937CGA-3r4g-5v92-9fq4CGA-3x65-4wqm-wqx7CGA-456h-vff7-pwghCGA-482h-4m78-xw63CGA-499m-fvrm-2gm2CGA-4gvx-3r97-243gCGA-4w7w-6qh3-cc6wCGA-4xwj-cv54-88j8CGA-537p-224p-6c8xCGA-58pq-v78p-7x3wCGA-596j-rxx9-6rwhCGA-5cg4-85f8-3xj4CGA-5v93-3c58-4g9vCGA-5xg2-p2xw-f3hrCGA-6gpx-r3j2-9gf3CGA-6m9m-8rrj-99x4CGA-6mmc-55g5-g3rjCGA-6pqx-fw6g-mc5qCGA-6vv8-7vcx-x7r4CGA-76qc-w5pp-6m59CGA-7p4q-r95h-9jc7CGA-7v5p-63xq-2cxgCGA-7xwg-vgg4-rgh6CGA-84vx-q4v3-r9jmCGA-86g4-rg6f-xgwjCGA-86gq-pq3q-hffvCGA-88v6-42cm-p93rCGA-8h33-258f-642fCGA-8hm2-2wq7-3mx2CGA-8q7m-8mgm-wj2vCGA-8v37-x7xv-9v9xCGA-94jr-qpvg-wqc2CGA-964r-wxcx-8h2qCGA-9cvm-xqj4-39q6CGA-9p28-75qj-67j7CGA-9r2r-4p2x-m47mCGA-c2q8-6mq9-fmvvCGA-c3f7-8mc9-9cwfCGA-c756-p28j-37mqCGA-c7xv-mrww-5m3fCGA-cgcv-9qjm-qjvfCGA-ch8f-xv24-77xhCGA-cpxv-6942-vqw4CGA-cr75-w9qh-cq38CGA-f2hx-x473-c2x9CGA-f3vf-88q3-p6m6CGA-f3x6-hw6m-6cgfCGA-f4vh-2w6m-6r4vCGA-f547-p58w-qp3qCGA-f5xx-2qc4-4345CGA-f74p-c2cm-x96pCGA-f79h-hg9r-7826CGA-f873-8qpv-rq66CGA-f9gp-624q-c6vwCGA-ffmp-gqwx-93q2CGA-ffq6-9hjr-7gcjCGA-fg2x-fjp5-v78gCGA-fmgm-2c33-pvfqCGA-fvw8-37jr-f633CGA-g3g8-6hf4-c2mhCGA-g3gh-qmqc-mjr5CGA-g6p5-9w3p-g9pgCGA-gc4x-w848-h79hCGA-ggv3-r6fg-9qqfCGA-ghfx-384m-4j7qCGA-gq3c-x2mh-qhv9CGA-gv8f-66jf-vwg9CGA-gvqw-6mfv-c5vqCGA-gxmf-gprh-45cwCGA-h663-cr2c-376rCGA-h7rf-4876-rjw7CGA-hf47-3c32-9cm7CGA-hg8w-cfcj-3pqqCGA-hmvj-75cq-2j5xCGA-hpf9-3h3x-2cf7CGA-hr53-744m-959wCGA-hrvp-5w45-956xCGA-j29f-xjjh-5m52CGA-jmcv-h77h-cxpjCGA-jmgf-jcg2-9gpcCGA-jp3w-3c55-3pgcCGA-jx4q-7p8x-p3fpCGA-m2cm-rhh7-5jf6CGA-m2cv-p3c3-9x9xCGA-m2vh-grjc-hjv6CGA-m6r9-mxmc-rc93CGA-m737-4fx8-2rjcCGA-m9gr-8rp9-wh2cCGA-m9gv-vxx2-768pCGA-mc27-cpcp-hc55CGA-mfhp-9phv-9g5pCGA-mp82-qph6-2rrrCGA-mx6w-wwf3-pjr9CGA-p4jx-hjq5-vv35CGA-p8wx-fg3c-vqpjCGA-pg56-47xf-v8rxCGA-pgwp-6fqm-25m3CGA-pprc-q277-6gxxGHSA-vfqx-33qm-g869CGA-pwcv-r38m-4c5xCGA-q2j3-xrgc-v7x9CGA-q39r-xgg4-4x33CGA-q63w-crqp-89fvCGA-qq7c-2rxm-4jrvCGA-r22v-r343-h48mCGA-r2qp-4wg5-fwm9CGA-r5p6-fwcw-2mg7CGA-r852-92h4-rg65CGA-rfj2-xq38-c9vpCGA-rgvp-g4q4-q5c7CGA-rh76-5w2c-qcr6CGA-rh77-vrjr-cj99CGA-rm72-w8fq-h6vgCGA-rqh8-74q9-x77vCGA-rw69-898q-6fwvCGA-rxjh-xfwx-ppf2CGA-v23r-2hg9-8x56CGA-v62f-gwxp-rj93CGA-v6mh-fgwp-w9hfCGA-vpg6-g68c-x4x5CGA-w34g-h22f-59r4CGA-w356-w3rh-42gxCGA-w6vf-rr2w-m74cCGA-wcgx-hgq7-hcrgCGA-wf6p-65c6-866wCGA-wrv4-hmc5-95q9CGA-x2p2-w49g-xc5fCGA-x7rf-74vg-64j2CGA-x7vv-w83v-5xjwCGA-x953-h5gf-fr9fCGA-xc63-rx7g-4v4rCGA-xm2m-69vj-wgfpCGA-xq7h-5893-q846CGA-xw8p-h94p-vf5qCGA-xx6f-g95p-r2gmCGA-xxjj-m4j3-285r
Published 06-01-2021Last modified 08-10-2026
Vulnerability summary
CVE-2020-36189 is a high (CVSS 8.1) Deserialization of Untrusted Data vulnerability in debian debian_linux. EPSS estimates a 3.99% chance of exploitation in the next 30 days, higher than 90.3% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.1/10
010
High · v3.1 (NVD)EPSS score
3.99%
0%100%
Low · -0.92 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 06-01-2021PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 8.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
3.99%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
-0.92 pp
From 4.91% on 18-09-2026
18-09-202618-10-2026
EPSS score3.99%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (cowtowncoder.medium.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard68 products
- eco-java-gradle-2.10All versions (No fix recorded)
- eco-java-gradle-2.11All versions (No fix recorded)
- eco-java-gradle-2.12All versions (No fix recorded)
- eco-java-gradle-2.13All versions (No fix recorded)
- eco-java-gradle-2.14All versions (No fix recorded)
Oracle36 products
- agile_product_lifecycle_management9.3.6
- application_testing_suite13.3.0.1
- autovue_for_agile_product_lifecycle_management21.0.2
- banking_platform2.6.2 | 2.7.0 | 2.7.1 | 2.8.0 | 2.9.0 | 2.10.0
- banking_treasury_management14.4
Debian2 products
- jackson-databind< 2.12.1-1
- debian_linuxEOL9.0
Netapp2 products
Com.fasterxml.jackson.core1 product
- jackson-databind≥ 2.7.0, < 2.9.10.8 | < 2.6.7.5
Fasterxml1 product
- jackson-databind≥ 2.0.0, < 2.6.7.5 | ≥ 2.7.0, < 2.9.10.8
Ubuntu1 product
- jackson-databindAll versions (No fix recorded)
7 vendors · 111 products
References
17 links- cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062X Refsource MISCREPORTEVIDENCEWEBExploitTechnical DescriptionThird Party Advisory
- github.com/FasterXML/jackson-databind/issues/2996X Refsource MISCREPORTWEBIssue TrackingThird Party Advisory
lists.debian.org/debian-lts-announce/2021/04/msg00025.htmlMailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory
