CVE-2021-20190

Published: Jan 19, 2021Modified: Jul 24, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Affected (11)

Products: Fasterxml: Jackson Databind · Netapp: Active Iq Unified Manager, Oncommand Api Services, Oncommand Insight, Service Level Manager · Apache: Nifi · +2 more

Show all products

Fasterxml: Jackson Databind · Netapp: Active Iq Unified Manager, Oncommand Api Services, Oncommand Insight, Service Level Manager · Apache: Nifi · Debian: Debian Linux · Oracle: Commerce Experience Manager, Commerce Guided Search

1 product

Jackson Databind

4 products

Active Iq Unified Manager

Oncommand Api Services

Oncommand Insight

Service Level Manager

1 product

1 product

2 products

Commerce Experience Manager

Commerce Guided Search

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Fasterxml Jackson Databind	Before 2.6.7.5
Fasterxml Jackson Databind	From 2.7.0 to 2.9.10.7

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	All versions
Netapp Active Iq Unified Manager	All versions
Netapp Oncommand Api Services	All versions
Netapp Oncommand Insight	All versions
Netapp Service Level Manager	All versions

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Apache Nifi	From 1.7.0 to 1.12.1

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Oracle Commerce Experience Manager	Version 11.3.2
Oracle Commerce Guided Search	Version 11.3.2

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (12)

https://bugzilla.redhat.com/show_bug.cgi?id=1916633

Source: secalert@redhat.com

Issue TrackingPatchThird Party Advisory

https://github.com/FasterXML/jackson-databind/issues/2854

Source: secalert@redhat.com

PatchThird Party Advisory

https://lists.apache.org/thread.html/r380e9257bacb8551ee6fcf2c59890ae9477b2c78e553fa9ea08e9d9a%40%3Ccommits.nifi.apache.org%3E

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20210219-0008/

Source: secalert@redhat.com

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1916633

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

https://github.com/FasterXML/jackson-databind/issues/2854

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://lists.apache.org/thread.html/r380e9257bacb8551ee6fcf2c59890ae9477b2c78e553fa9ea08e9d9a%40%3Ccommits.nifi.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20210219-0008/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.