CVE-2020-9547: debian debian_linux Deserialization of Untrusted Data

Modified

AliasesUBUNTU-CVE-2020-9547DEBIAN-CVE-2020-9547CGA-2458-899m-p689+145 more

Published 02-03-2020Last modified 07-10-2026

Vulnerability summary

CVE-2020-9547 is a critical (CVSS 9.8) Deserialization of Untrusted Data vulnerability in debian debian_linux. EPSS estimates a 18.38% chance of exploitation in the next 30 days, higher than 97.2% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 9.8 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 18% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

9.8/10

010

Critical · v3.1 (CVE.org)

EPSS score

18.38%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 14 · Related 1

DLA-2135-1 MGASA-2021-0153 RHBA-2020:1494 RHBA-2020:3255 RHSA-2020:1644 RHSA-2020:2511+8 more

Timeline

02-03-2020
PublishedVulnerability first disclosed.
07-10-2026
Last modifiedVulnerability information updated.

Description

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

CVSS metrics

7 scores · 6 sources · 2 versions

v3.19.8v2.06.8

EPSS trend

Probability

18.38%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

No change 0.00 pp

From 18.38% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard68 products

eco-java-gradle-2.10All versions (No fix recorded)
eco-java-gradle-2.11All versions (No fix recorded)
eco-java-gradle-2.12All versions (No fix recorded)
eco-java-gradle-2.13All versions (No fix recorded)
eco-java-gradle-2.14All versions (No fix recorded)

eco-java-gradle-2.14.1All versions (No fix recorded)
eco-java-gradle-2.4All versions (No fix recorded)
eco-java-gradle-2.5All versions (No fix recorded)
eco-java-gradle-2.6All versions (No fix recorded)
eco-java-gradle-2.7All versions (No fix recorded)
eco-java-gradle-2.8All versions (No fix recorded)
eco-java-gradle-2.9All versions (No fix recorded)
eco-java-gradle-3.0All versions (No fix recorded)
eco-java-gradle-3.1All versions (No fix recorded)
eco-java-gradle-3.2All versions (No fix recorded)
eco-java-gradle-3.2.1All versions (No fix recorded)
eco-java-gradle-3.3All versions (No fix recorded)
eco-java-gradle-3.4All versions (No fix recorded)
eco-java-gradle-3.4.1All versions (No fix recorded)
eco-java-gradle-3.5All versions (No fix recorded)
eco-java-gradle-3.5.1All versions (No fix recorded)
eco-java-gradle-4.0All versions (No fix recorded)
eco-java-gradle-4.0.1All versions (No fix recorded)
eco-java-gradle-4.0.2All versions (No fix recorded)
eco-java-gradle-4.1All versions (No fix recorded)
eco-java-gradle-4.10All versions (No fix recorded)
eco-java-gradle-4.10.1All versions (No fix recorded)
eco-java-gradle-4.10.2All versions (No fix recorded)
eco-java-gradle-4.10.3All versions (No fix recorded)
eco-java-gradle-4.2All versions (No fix recorded)
eco-java-gradle-4.2.1All versions (No fix recorded)
eco-java-gradle-4.3All versions (No fix recorded)
eco-java-gradle-4.3.1All versions (No fix recorded)
eco-java-gradle-4.4All versions (No fix recorded)
eco-java-gradle-4.4.1All versions (No fix recorded)
eco-java-gradle-4.5All versions (No fix recorded)
eco-java-gradle-4.5.1All versions (No fix recorded)
eco-java-gradle-4.6All versions (No fix recorded)
eco-java-gradle-4.7All versions (No fix recorded)
eco-java-gradle-4.8All versions (No fix recorded)
eco-java-gradle-4.8.1All versions (No fix recorded)
eco-java-gradle-4.9All versions (No fix recorded)
eco-java-gradle-5.0All versions (No fix recorded)
eco-java-gradle-5.1All versions (No fix recorded)
eco-java-gradle-5.1.1All versions (No fix recorded)
eco-java-gradle-5.2All versions (No fix recorded)
eco-java-gradle-5.2.1All versions (No fix recorded)
eco-java-gradle-5.3All versions (No fix recorded)
eco-java-gradle-5.3.1All versions (No fix recorded)
eco-java-gradle-5.4All versions (No fix recorded)
eco-java-gradle-5.4.1All versions (No fix recorded)
eco-java-gradle-5.5All versions (No fix recorded)
eco-java-gradle-5.5.1All versions (No fix recorded)
eco-java-gradle-5.6All versions (No fix recorded)
eco-java-gradle-5.6.1All versions (No fix recorded)
eco-java-gradle-5.6.2All versions (No fix recorded)
eco-java-gradle-5.6.3All versions (No fix recorded)
eco-java-gradle-5.6.4All versions (No fix recorded)
eco-java-gradle-6.0All versions (No fix recorded)
eco-java-gradle-6.0.1All versions (No fix recorded)
eco-java-gradle-6.1All versions (No fix recorded)
eco-java-gradle-6.1.1All versions (No fix recorded)
eco-java-gradle-6.2All versions (No fix recorded)
eco-java-gradle-6.2.1All versions (No fix recorded)
eco-java-gradle-6.2.2All versions (No fix recorded)
hadoop-fips-3.3.6All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5All versions (No fix recorded)

Show all 68

Oracle13 products

autovue_for_agile_product_lifecycle_management21.0.2
banking_platform≥ 2.4.0, ≤ 2.9.0
communications_contacts_server8.0.0.4.0
communications_evolved_communications_application_server7.1
communications_instant_messaging_server10.0.1.4.0

Show all 13

Debian2 products

jackson-databind< 2.11.1-1
debian_linuxEOL8.0

Com.fasterxml.jackson.core1 product

jackson-databind≥ 2.9.0, < 2.9.10.4 | ≥ 2.8.0, < 2.8.11.6 | ≥ 2.0.0, < 2.7.9.7

Fasterxml1 product

jackson-databind≥ 2.0.0, < 2.7.9.7 | ≥ 2.8.0, < 2.8.11.6 | ≥ 2.9.0, < 2.9.10.4

Netapp1 product

active_iq_unified_manager≥ 7.3 (No fix recorded) | ≥ 9.5 (No fix recorded)

Ubuntu1 product

jackson-databindAll versions (No fix recorded) | < 2.4.2-3ubuntu0.1~esm2

7 vendors · 87 products

References

47 links

lists.debian.org/debian-lts-announce/2020/03/msg00008.htmlMailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062X Refsource MISCWEB

Show all 47 references

www.oracle.com/security-alerts/cpujul2020.htmlX Refsource MISCAdvisoryWEBThird Party Advisory
lists.apache.org/thread.html/…X Refsource MISCWEB
github.com/FasterXML/jackson-databind/issues/2634X Refsource MISCREPORTFIXWEBPatchThird Party Advisory
lists.apache.org/thread.html/…X Refsource MISCWEB
lists.apache.org/thread.html/…X Refsource MISCWEB
lists.apache.org/thread.html/…X Refsource MISCWEB
lists.apache.org/thread.html/…X Refsource MISCWEB
lists.apache.org/thread.html/…X Refsource MISCWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
www.oracle.com/security-alerts/cpuoct2020.htmlX Refsource MISCFIXWEBPatchThird Party Advisory
security.netapp.com/advisory/ntap-20200904-0006/X Refsource CONFIRMAdvisoryThird Party Advisory
www.oracle.com/security-alerts/cpujan2021.htmlX Refsource MISCFIXWEBPatchThird Party Advisory
www.oracle.com/security-alerts/cpuoct2021.htmlX Refsource MISCFIXWEBPatchThird Party Advisory
ubuntu.com/security/CVE-2020-9547REPORT
medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062REPORTWEB
ubuntu.com/security/notices/USN-4813-1Advisory
www.cve.org/CVERecord?id=CVE-2020-9547REPORT
security-tracker.debian.org/tracker/CVE-2020-9547Advisory
nvd.nist.gov/vuln/detail/CVE-2020-9547Advisory
github.com/FasterXML/jackson-databind/commit/9f4e97019fb0dd836533d0b6198c88787e235ae2WEB
security.netapp.com/advisory/ntap-20200904-0006WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
github.com/FasterXML/jackson-databindPACKAGE