CVE-2020-14061
HighCVSS 8.1Exploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).
Risk Assessment
The vulnerability may allow remote code execution or unauthorized access, especially in environments using Oracle JMS.
Recommendation
Update jackson-databind to version 2.9.10.5 or later. Restrict typing usage and apply class allowlists.
Original NVD description (English source)
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).