CVE-2020-9548 in the critical feed json
jackson-databind mishandles the interaction between serialization gadgets and typing
published 6y ago modified last mo. also GHSA-p43x-xfjf-5jhr , EUVD-2020-0433
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 18.9%
- EPSS 18.9% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
Patch / fix
- maven com.fasterxml.jackson.core:jackson-databind 2.7.9.7, 2.8.11.6, 2.9.10.4
- fasterxml jackson-databind 2.7.9.7, 2.8.11.6, 2.9.10.4
- oracle global_lifecycle_management_opatch 12.2.0.1.20
- oracle jd_edwards_enterpriseone_orchestrator 9.2.4.2
- oracle jd_edwards_enterpriseone_tools 9.2.4.2
- jackson-databind Debian 14, Debian 13, Debian 12 2.11.1-1
debian advisories DEBIAN-CVE-2020-9548
- jackson-databind Ubuntu Pro 16.04 LTS 2.4.2-3ubuntu0.1~esm2
ubuntu advisories UBUNTU-CVE-2020-9548
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- eap7-txw2 jboss enterprise application platform 7.3 2.3.3-4.b02_redhat_00001.1.el7eap
- eap7-xsom jboss enterprise application platform 7.3 2.3.3-4.b02_redhat_00001.1.el7eap
- eap7-rngom jboss enterprise application platform 7.3 2.3.3-4.b02_redhat_00001.1.el7eap
- eap7-wss4j jboss enterprise application platform 7.3 2.2.5-1.redhat_00001.1.el7eap
- eap7-jandex jboss enterprise application platform 7.3 2.1.2-1.Final_redhat_00001.1.el7eap
- eap7-jasypt jboss enterprise application platform 7.3 1.9.3-1.redhat_00001.1.el7eap
- eap7-wildfly jboss enterprise application platform 7.3 7.3.1-5.GA_redhat_00003.1.el7eap
- eap7-jaxb-jxc jboss enterprise application platform 7.3 2.3.3-4.b02_redhat_00001.1.el7eap
red hat advisories RHSA-2025:1746RHSA-2020:2512RHSA-2020:2511RHSA-2020:2513RHSA-2020:4366RHSA-2020:3639
- xsom AlmaLinux 8 0-19.20110809svn.module_el8.5.0+2577+9e95fe00
- slf4j AlmaLinux 8 1.7.25-4.module_el8.5.0+2577+9e95fe00
- stax-ex AlmaLinux 8 1.7.7-8.module_el8.5.0+2577+9e95fe00
- velocity AlmaLinux 8 1.7-24.module_el8.5.0+2577+9e95fe00
- xalan-j2 AlmaLinux 8 2.7.1-38.module_el8.5.0+2577+9e95fe00
- javassist AlmaLinux 8 3.18.1-8.module_el8.5.0+2577+9e95fe00
- xerces-j2 AlmaLinux 8 2.11.0-34.module_el8.5.0+2577+9e95fe00
- python3-nss AlmaLinux 8 1.0.1-10.module_el8.5.0+2577+9e95fe00.alma
almalinux advisories ALSA-2020:1644
- xsom Rocky Linux 8 0-19.20110809svn.module+el8.3.0+53+ea062990
- slf4j Rocky Linux 8 1.7.25-4.module+el8.5.0+697+f586bb30
- slf4j Rocky Linux 8 1.7.25-4.module+el8.3.0+74+855e3f5d
- slf4j Rocky Linux 8 1.7.25-4.module+el8.3.0+133+b8b54b58
- stax-ex Rocky Linux 8 1.7.7-8.module+el8.3.0+53+ea062990
- bea-stax Rocky Linux 8 1.2.0-16.module+el8.3.0+53+ea062990
- resteasy Rocky Linux 8 3.0.26-3.module+el8.3.0+53+ea062990
- velocity Rocky Linux 8 1.7-24.module+el8.3.0+53+ea062990
rocky linux advisories RLSA-2020:1644
- github.com/FasterXML/jackson-databind@1e64db6 commit
- github.com/FasterXML/jackson-databind@9f4e970 commit
- github.com/FasterXML/jackson-databind/issues/2634 advisory
- oracle.com/security-alerts/cpuoct2020.html advisory
- oracle.com/security-alerts/cpujan2021.html advisory
- oracle.com/security-alerts/cpuoct2021.html advisory
Is CVE-2020-9548 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2020-9548 updated cvss 8.1
jackson-databind: Serialization gadgets in anteros-core
-
Red Hat JBoss A-MQ 6 jackson-databind Red Hat JBoss Enterprise Application Platform Continuous Delivery jackson-databind Red Hat JBoss Fuse 6 jackson-databind Red Hat Mobile Application Platform 4 jackson-databindaffected: no fix planned “Out of support scope”
-
Red Hat OpenShift Application Runtimes jackson-databindaffected: no fix available
-
Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5 Red Hat OpenShift Container Platform 4 openshift4/ose-logging-elasticsearch5affected: no fix planned “Will not fix”
-
Red Hat OpenStack Platform 10 (Newton) opendaylightaffected: no fix planned “Out of support scope”
-
Red Hat OpenStack Platform 13 (Queens) opendaylight Red Hat Software Collections rh-maven35-jackson-databind, rh-maven35-jackson-databind-javadocaffected: no fix planned “Will not fix”
-
Red Hat Data Grid 7.3.7fixed: vendor fix RHSA-2020:3779
-
Red Hat Decision Manager 7fixed: vendor fix RHSA-2020:3196
-
Red Hat Enterprise Linux AppStream (v. 8) jss 4.6.2-4.module+el8.2.0+6123+b4678599, slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, pki-ca 10.8.3-1.module+el8.2.0+5925+bad5981a, stax-ex 1.7.7-8.module+el8.1.0+3366+6dfb954c, velocity 1.7-24.module+el8.1.0+3366+6dfb954c, ldapjdk 4.21.0-2.module+el8.2.0+4573+c3c38c7b, +43 morefixed: vendor fix RHSA-2020:1644
show 19 moreshow fewer
-
Red Hat Fuse 7.7.0fixed: vendor fix RHSA-2020:3192
-
Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el6eap, eap7-wildfly 7.2.9-4.GA_redhat_00003.1.el6eap, eap7-resteasy 3.6.1-10.SP9_redhat_00001.1.el6eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el6eap, eap7-weld-ejb 3.0.6-4.Final_redhat_00004.1.el6eap, eap7-weld-jta 3.0.6-4.Final_redhat_00004.1.el6eap, +83 morefixed: vendor fix RHSA-2020:3637
-
Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el7eap, eap7-wildfly 7.2.9-4.GA_redhat_00003.1.el7eap, eap7-resteasy 3.6.1-10.SP9_redhat_00001.1.el7eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el7eap, eap7-weld-ejb 3.0.6-4.Final_redhat_00004.1.el7eap, eap7-weld-jta 3.0.6-4.Final_redhat_00004.1.el7eap, +85 morefixed: vendor fix RHSA-2020:3638
-
Red Hat JBoss EAP 7.2 for RHEL 8 eap7-dom4j 2.1.3-1.redhat_00001.1.el8eap, eap7-wildfly 7.2.9-4.GA_redhat_00003.1.el8eap, eap7-resteasy 3.6.1-10.SP9_redhat_00001.1.el8eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el8eap, eap7-weld-ejb 3.0.6-4.Final_redhat_00004.1.el8eap, eap7-weld-jta 3.0.6-4.Final_redhat_00004.1.el8eap, +83 morefixed: vendor fix RHSA-2020:3639
-
Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-wss4j 2.2.5-1.redhat_00001.1.el8eap, eap7-jasypt 1.9.3-1.redhat_00001.1.el8eap, eap7-opensaml 3.3.1-1.redhat_00002.1.el8eap, eap7-txw2 2.3.3-4.b02_redhat_00001.1.el8eap, eap7-xsom 2.3.3-4.b02_redhat_00001.1.el8eap, eap7-rngom 2.3.3-4.b02_redhat_00001.1.el8eap, +194 morefixed: vendor fix RHSA-2020:2513
-
Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-wss4j 2.2.5-1.redhat_00001.1.el6eap, eap7-jasypt 1.9.3-1.redhat_00001.1.el6eap, eap7-opensaml 3.3.1-1.redhat_00002.1.el6eap, eap7-txw2 2.3.3-4.b02_redhat_00001.1.el6eap, eap7-xsom 2.3.3-4.b02_redhat_00001.1.el6eap, eap7-rngom 2.3.3-4.b02_redhat_00001.1.el6eap, +194 morefixed: vendor fix RHSA-2020:2511
-
Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-wss4j 2.2.5-1.redhat_00001.1.el7eap, eap7-jasypt 1.9.3-1.redhat_00001.1.el7eap, eap7-opensaml 3.3.1-1.redhat_00002.1.el7eap, eap7-txw2 2.3.3-4.b02_redhat_00001.1.el7eap, eap7-xsom 2.3.3-4.b02_redhat_00001.1.el7eap, eap7-rngom 2.3.3-4.b02_redhat_00001.1.el7eap, +196 morefixed: vendor fix RHSA-2020:2512
-
Red Hat JBoss Enterprise Application Platform 7fixed: vendor fix RHSA-2020:2515
-
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-resteasy 3.0.27-1.Final_redhat_00001.1.ep7.el7, eap7-resteasy-cdi 3.0.27-1.Final_redhat_00001.1.ep7.el7, eap7-resteasy-jaxrs 3.0.27-1.Final_redhat_00001.1.ep7.el7, eap7-resteasy-jsapi 3.0.27-1.Final_redhat_00001.1.ep7.el7, eap7-resteasy-client 3.0.27-1.Final_redhat_00001.1.ep7.el7, eap7-resteasy-crypto 3.0.27-1.Final_redhat_00001.1.ep7.el7, +12 morefixed: vendor fix RHSA-2025:1746
-
Red Hat Process Automation 7fixed: vendor fix RHSA-2020:3197
-
Red Hat Satellite 6.6 satellite 6.6.3-1.el7sat, candlepin 2.6.16-1.el7sat, foreman 1.22.0.39-2.el7sat, satellite-cli 6.6.3-1.el7sat, foreman-cli 1.22.0.39-2.el7sat, foreman-ec2 1.22.0.39-2.el7sat, +17 morefixed: vendor fix RHBA-2020:1494
-
Red Hat Satellite 6.7 satellite 6.7.2-1.el7sat, candlepin 2.9.28-1.el7sat, foreman 1.24.1.24-1.el7sat, pulp-rpm 2.21.0.6-1.el7sat, satellite-cli 6.7.2-1.el7sat, foreman-cli 1.24.1.24-1.el7sat, +27 morefixed: vendor fix RHBA-2020:3255
-
Red Hat Satellite 6.8 tfm 6.1-1.el7sat, kobo 0.5.1-1.el7sat, pulp 2.21.3-1.el7sat, gofer 2.12.5-7.el7sat, receptor 0.6.3-1.el7ar, future 0.16.0-11.el7sat, +488 morefixed: vendor fix RHSA-2020:4366
-
Red Hat Satellite Capsule 6.6 satellite 6.6.3-1.el7sat, foreman 1.22.0.39-2.el7sat, satellite-common 6.6.3-1.el7sat, satellite-capsule 6.6.3-1.el7sat, satellite-debug-tools 6.6.3-1.el7satfixed: vendor fix RHBA-2020:1494
-
Red Hat Satellite Capsule 6.7 satellite 6.7.2-1.el7sat, foreman 1.24.1.24-1.el7sat, pulp-rpm 2.21.0.6-1.el7sat, satellite-common 6.7.2-1.el7sat, satellite-capsule 6.7.2-1.el7sat, pulp-rpm-plugins 2.21.0.6-1.el7sat, +6 morefixed: vendor fix RHBA-2020:3255
-
Red Hat Satellite Capsule 6.8 tfm 6.1-1.el7sat, kobo 0.5.1-1.el7sat, pulp 2.21.3-1.el7sat, gofer 2.12.5-7.el7sat, future 0.16.0-11.el7sat, katello 3.16.0-1.el7sat, +232 morefixed: vendor fix RHSA-2020:4366
-
Red Hat Single Sign-On 7.4.1fixed: vendor fix RHSA-2020:2813
-
Red Hat Text-Only RHOARfixed: vendor fix RHSA-2020:2067
-
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-jettison 1.3.8-2.redhat_00002.1.ep7.el7, eap7-velocity 1.7.0-3.redhat_00006.1.ep7.el7, eap7-wildfly 7.1.9-2.GA_redhat_00002.1.ep7.el7, eap7-apache-cxf 3.1.16-4.redhat_00003.1.ep7.el7, eap7-netty 4.1.63-1.Final_redhat_00002.1.ep7.el7, eap7-apache-cxf-rt 3.1.16-4.redhat_00003.1.ep7.el7, +5 more Red Hat streams for Apache Kafka jackson-databindnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- last mo.
Exploit prediction
18.92% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Nuclei template FasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.fasterxml.jackson.core:jackson-databind | >=2.9.0, <2.9.10.4 >=2.8.0, <2.8.11.6 >=2.0.0, <2.7.9.7 |
2.9.10.4 2.8.11.6 2.7.9.7 |
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/FasterXML/jackson-databind/issues/2634
web, patch, third-party-advisory
-
oracle.com
/security-alerts/cpuoct2020.html
web, patch, third-party-advisory
-
oracle.com
/security-alerts/cpujan2021.html
web, patch, third-party-advisory
-
oracle.com
/security-alerts/cpuoct2021.html
web, patch, third-party-advisory
-
github.com
/FasterXML/jackson-databind/commit/1e64db6a2fad331f96c7363fda3bc5f3dffa25bb
web
-
github.com
/FasterXML/jackson-databind/commit/9f4e97019fb0dd836533d0b6198c88787e235ae2
web
-
lists.debian.org
/debian-lts-announce/2020/03/msg00008.html
mailing-list, web, third-party-advisory
-
lists.apache.org
/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3E
mailing-list
- medium.com /%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
-
oracle.com
/security-alerts/cpujul2020.html
web, mailing-list, third-party-advisory
-
lists.apache.org
/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
mailing-list
-
security.netapp.com
/advisory/ntap-20200904-0006/
third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-9548
advisory
-
security.netapp.com
/advisory/ntap-20200904-0006
web
-
medium.com
/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
web
-
lists.apache.org
/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E
web
-
lists.apache.org
/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097@%3Cissues.zookeeper.apache.org%3E
web
-
lists.apache.org
/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6@%3Cissues.zookeeper.apache.org%3E
web
-
lists.apache.org
/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca@%3Cissues.zookeeper.apache.org%3E
web
-
lists.apache.org
/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596@%3Cissues.zookeeper.apache.org%3E
web
-
lists.apache.org
/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb@%3Cissues.zookeeper.apache.org%3E
web
-
lists.apache.org
/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1@%3Cdev.zookeeper.apache.org%3E
web
-
lists.apache.org
/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd@%3Cissues.zookeeper.apache.org%3E
web
-
github.com
/FasterXML/jackson-databind
package
Sources
- CVE List CVE-2020-9548
- GitHub Advisory GHSA-p43x-xfjf-5jhr
- NVD CVE-2020-9548
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.