CVE-2020-10672: jackson-databind mishandles the interaction between serialization gadgets and typing
Summary
CVE-2020-10672: jackson-databind mishandles the interaction between serialization gadgets and typing. Affects com.fasterxml.jackson.core:jackson-databind versions >= 2.9.0, < 2.9.10.4. Fixed in 2.9.10.4. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2020-10672 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jackson-databind package is a part of the FasterXML Jackson library, which provides a set of data-binding APIs for converting Java objects to and from JSON. It is widely used in Java applications for JSON serialization and deserialization. This vulnerability affects versions 2.x before 2.9.10.4 of jackson-databind. The specific component affected is org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aries.transaction.jms).
Vulnerability Detail
The vulnerability in jackson-databind arises due to mishandling the interaction between serialization gadgets and typing. This can lead to various security issues, including remote code execution (RCE) and deserialization attacks. An attacker can exploit this vulnerability by crafting a malicious payload that, when deserialized by a vulnerable application, triggers the execution of arbitrary code. This can result in unauthorized access, data leakage, or even a complete compromise of the affected system.
How To Fix
Latest published version: 2.22.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.9.10.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, if upgrading to the fixed version is not immediately feasible, developers can consider implementing input validation and sanitization techniques to mitigate the risk of deserialization attacks. This involves carefully validating and filtering any user-supplied input before deserializing it using jackson-databind. By ensuring that only trusted and expected data is processed, the impact of this vulnerability can be reduced.
Conclusion
In conclusion, the CVE-2020-10672 vulnerability in jackson-databind can lead to remote code execution and deserialization attacks. It is crucial to upgrade to the fixed version of the package (2.9.10.4 or later) and keep all software components up to date. Implementing input validation and sanitization techniques can provide temporary mitigation. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
jackson-databind is a component of the FasterXML Jackson library, which provides data-binding APIs for converting Java objects to and from JSON. It is commonly used in Java applications for JSON serialization and deserialization.
This vulnerability can lead to remote code execution (RCE) and deserialization attacks. An attacker can exploit it to execute arbitrary code on the affected system, potentially gaining unauthorized access or causing data leakage.
To fix this vulnerability, you should upgrade the jackson-databind package to version 2.9.10.4 or later. It is important to keep all software components up to date to mitigate the risk of similar vulnerabilities.
As a temporary workaround, you can implement input validation and sanitization techniques to reduce the risk of deserialization attacks. This involves carefully validating and filtering user-supplied input before deserializing it using jackson-databind.
For more information about this vulnerability, you can refer to the CVE-2020-10672 advisory or contact the developers of the jackson-databind package.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
