GHSA-5949-rw7g-wx7w

Deserialization of untrusted data in jackson-databind

At a glance

Published: 2021-01-20 21:20 UTC
Updated: 2025-09-15 07:42 UTC
CVE: CVE-2021-20190
Aliases: BIT-nifi-2021-20190
CVSS_V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

A flaw was found in jackson-databind before 2.9.10.7 and 2.6.7.5. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Affected packages

Package	Versions
Maven · com.fasterxml.jackson.core:jackson-databind	introduced 2.7.0, fixed 2.9.10.7
Maven · com.fasterxml.jackson.core:jackson-databind	introduced 0, fixed 2.6.7.5

References

https://nvd.nist.gov/vuln/detail/CVE-2021-20190 ADVISORY
https://github.com/FasterXML/jackson-databind/issues/2854 WEB
https://github.com/FasterXML/jackson-databind/commit/08fbfacf89a4a4c026a6227a1b470ab7a13e2e88 WEB
https://github.com/FasterXML/jackson-databind/commit/7dbf51bf78d157098074a20bd9da39bd48c18e4a WEB
https://bugzilla.redhat.com/show_bug.cgi?id=1916633 WEB
https://github.com/FasterXML/jackson-databind PACKAGE
https://lists.apache.org/thread.html/r380e9257bacb8551ee6fcf2c59890ae9477b2c78e553fa9ea08e9d9a@%3Ccommits.nifi.apache.org%3E WEB
https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html WEB
https://security.netapp.com/advisory/ntap-20210219-0008 WEB
https://www.oracle.com//security-alerts/cpujul2021.html WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database