Vulnerability Description
A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fasterxml | Jackson-Databind | < 2.6.7.5 |
| Netapp | Active Iq Unified Manager | - |
| Netapp | Oncommand Api Services | - |
| Netapp | Oncommand Insight | - |
| Netapp | Service Level Manager | - |
| Apache | Nifi | >= 1.7.0, <= 1.12.1 |
| Debian | Debian Linux | 9.0 |
| Oracle | Commerce Guided Search And Experience Manager | 11.3.2 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1916633Issue TrackingPatchThird Party Advisory
- https://github.com/FasterXML/jackson-databind/issues/2854PatchThird Party Advisory
- https://lists.apache.org/thread.html/r380e9257bacb8551ee6fcf2c59890ae9477b2c78e5
- https://lists.debian.org/debian-lts-announce/2021/04/msg00025.htmlMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20210219-0008/Third Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1916633Issue TrackingPatchThird Party Advisory
- https://github.com/FasterXML/jackson-databind/issues/2854PatchThird Party Advisory
- https://lists.apache.org/thread.html/r380e9257bacb8551ee6fcf2c59890ae9477b2c78e5
- https://lists.debian.org/debian-lts-announce/2021/04/msg00025.htmlMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20210219-0008/Third Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlThird Party Advisory
FAQ
What is CVE-2021-20190?
CVE-2021-20190 is a vulnerability with a CVSS score of 8.1 (HIGH). A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiali...
How severe is CVE-2021-20190?
CVE-2021-20190 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-20190?
Check the references section above for vendor advisories and patch information. Affected products include: Fasterxml Jackson-Databind, Netapp Active Iq Unified Manager, Netapp Oncommand Api Services, Netapp Oncommand Insight, Netapp Service Level Manager.