CVE Catalog
CVE-2020-36189
HighCVSS 8.1Exploitation Probability (EPSS)
Very high risk4.91%
91th percentile - higher than 91% of all known CVEs
Summary
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.
Risk Assessment
The vulnerability may allow remote code execution or unauthorized access if the application uses jackson-databind with typing enabled.
Recommendation
Update jackson-databind to version 2.9.10.8 or later. If possible, disable typing or configure class allowlists.
Original NVD description (English source)
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.