CVE-2020-8840
CRITICAL
Deserialization of Untrusted Data in jackson-databind
Published March 4, 2020Updated March 16, 2024Source: osv
Summary
FasterXML jackson-databind 2.x before 2.6.7.4, 2.7.x before 2.7.9.7, 2.8.x before 2.8.11.5 and 2.9.x before 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
Remediation
Upgrade to the fixed version using your package manager.
Maven
Update com.fasterxml.jackson.core:jackson-databind to 2.8.11.5 or later<!-- Update pom.xml dependency version to 2.8.11.5 for com.fasterxml.jackson.core:jackson-databind -->
Maven
Update com.fasterxml.jackson.core:jackson-databind to 2.9.10.3 or later<!-- Update pom.xml dependency version to 2.9.10.3 for com.fasterxml.jackson.core:jackson-databind -->
Maven
Update com.fasterxml.jackson.core:jackson-databind to 2.6.7.4 or later<!-- Update pom.xml dependency version to 2.6.7.4 for com.fasterxml.jackson.core:jackson-databind -->
Maven
Update com.fasterxml.jackson.core:jackson-databind to 2.7.9.7 or later<!-- Update pom.xml dependency version to 2.7.9.7 for com.fasterxml.jackson.core:jackson-databind -->
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (4)
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| com.fasterxml.jackson.core:jackson-databind | maven | 2.8.0, 2.8.1, 2.8.10, 2.8.11 (+13 more) | 2.8.11.5 |
| com.fasterxml.jackson.core:jackson-databind | maven | 2.9.0, 2.9.0.pr1, 2.9.0.pr2, 2.9.0.pr3 (+16 more) | 2.9.10.3 |
| com.fasterxml.jackson.core:jackson-databind | maven | 2.0.0, 2.0.1, 2.0.2, 2.0.4 (+58 more) | 2.6.7.4 |
| com.fasterxml.jackson.core:jackson-databind | maven | 2.7.0, 2.7.1, 2.7.1-1, 2.7.2 (+13 more) | 2.7.9.7 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-502Deserialization of Untrusted DataMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-8840ADVISORY
- https://github.com/FasterXML/jackson-databind/issues/2620WEB
- https://github.com/FasterXML/jackson-databind/commit/74aba4042fce35ee0b91bd2847e788c10040d78bWEB
- https://github.com/FasterXML/jackson-databind/commit/914e7c9f2cb8ce66724bf26a72adc7e958992497WEB
- https://github.com/FasterXML/jackson-databind/commit/9bb52c7122271df75435ec7e66ecf6b02b1ee14fWEB
- https://lists.apache.org/thread.html/ra275f29615f35d5b40106d1582a41e5388b2a5131564e9e01a572987@%3Cdev.ranger.apache.org%3EWEB
- https://lists.apache.org/thread.html/rac5ee5d686818be7e7c430d35108ee01a88aae54f832d32f62431fd1@%3Cnotifications.zookeeper.apache.org%3EWEB
- https://lists.apache.org/thread.html/rb43f9a65150948a6bebd3cb77ee3e105d40db2820fd547528f4e7f89@%3Cissues.zookeeper.apache.org%3EWEB
- https://lists.apache.org/thread.html/rb5eedf90ba3633e171a2ffdfe484651c9490dc5df74c8a29244cbc0e@%3Ccommits.zookeeper.apache.org%3EWEB
- https://lists.apache.org/thread.html/rb73708bf714ed6dbc1212da082e7703e586077f0c92f3940b2e82caf@%3Cdev.ranger.apache.org%3EWEB
- https://lists.apache.org/thread.html/rb99c7321eba5d4c907beec46675d52827528b738cfafd48eb4d862f1@%3Cdev.tomee.apache.org%3EWEB
- https://lists.apache.org/thread.html/rc068e824654c4b8bd4f2490bec869e29edbfcd5dfe02d47cbf7433b2@%3Cdev.tomee.apache.org%3EWEB
- https://lists.apache.org/thread.html/rc717fd6c65190f4e592345713f9ef0723fb7d71f624caa2a17caa26a@%3Cdev.ranger.apache.org%3EWEB
- https://lists.apache.org/thread.html/rcc72b497e3dff2dc62ec9b89ceb90bc4e1b14fc56c3c252a6fcbb013@%3Cdev.ranger.apache.org%3EWEB
- https://lists.apache.org/thread.html/rdea588d4a0ebf9cb7ce8c3a8f18d0d306507c4f8ba178dd3d20207b8@%3Cdev.tomee.apache.org%3EWEB
- https://lists.apache.org/thread.html/rdf311f13e6356297e0ffe74397fdd25a3687b0a16e687c3ff5b834d8@%3Cdev.ranger.apache.org%3EWEB
- https://lists.apache.org/thread.html/rdf8d389271a291dde3b2f99c36918d6cb1e796958af626cc140fee23@%3Ccommits.zookeeper.apache.org%3EWEB
- https://lists.apache.org/thread.html/re7326b8655eab931f2a9ce074fd9a1a51b5db11456bee9b48e1e170c@%3Cissues.zookeeper.apache.org%3EWEB
- https://lists.apache.org/thread.html/re8ae2670ec456ef1c5a2a661a2838ab2cd00e9efa1e88c069f546f21@%3Ccommits.zookeeper.apache.org%3EWEB
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3EWEB
- https://lists.apache.org/thread.html/rf28ab6f224b48452afd567dfffb705fbda0fdbbf6535f6bc69d47e91@%3Cdev.ranger.apache.org%3EWEB
- https://lists.apache.org/thread.html/rfc1ccfe89332155b72ce17f13a2701d3e7b9ec213324ceb90e79a28a@%3Cdev.ranger.apache.org%3EWEB
- https://lists.debian.org/debian-lts-announce/2020/02/msg00020.htmlWEB
- https://security.netapp.com/advisory/ntap-20200327-0002WEB
- https://www.oracle.com/security-alerts/cpuapr2020.htmlWEB
- https://www.oracle.com/security-alerts/cpuoct2020.htmlWEB
- https://github.com/FasterXML/jackson-databindPACKAGE
- https://lists.apache.org/thread.html/r078e68a926ea6be12e8404e47f45aabf04bb4668e8265c0de41db6db@%3Ccommits.druid.apache.org%3EWEB
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3EWEB
- https://lists.apache.org/thread.html/r1c09b9551f6953dbeca190a4c4b78198cdbb9825fce36f96fe3d8218@%3Cdev.tomee.apache.org%3EWEB
- https://lists.apache.org/thread.html/r1efc776fc6ce3387593deaa94bbdd296733b1b01408a39c8d1ab9e0e@%3Cdev.ranger.apache.org%3EWEB
- https://lists.apache.org/thread.html/r2fa8046bd47fb407ca09b5107a80fa6147ba4ebe879caae5c98b7657@%3Cdev.ranger.apache.org%3EWEB
- https://lists.apache.org/thread.html/r319f19c74e06c201b9d4e8b282a4e4b2da6dcda022fb46f007dd00d3@%3Ccommits.druid.apache.org%3EWEB
- https://lists.apache.org/thread.html/r3539bd3a377991217d724879d239e16e86001c54160076408574e1da@%3Cnotifications.zookeeper.apache.org%3EWEB
- https://lists.apache.org/thread.html/r3d20a2660b36551fd8257d479941782af4a7169582449fac1704bde2@%3Ccommits.druid.apache.org%3EWEB
- https://lists.apache.org/thread.html/r428d068b2a4923f1a5a4f5fc6381b95205cfe7620169d16db78e9c71@%3Cnotifications.zookeeper.apache.org%3EWEB
- https://lists.apache.org/thread.html/r446646c5588b10f5e02409ad580b12f314869009cdfbf844ca395cec@%3Cdev.ranger.apache.org%3EWEB
- https://lists.apache.org/thread.html/r46bebdeb59b8b7212d63a010ca445a9f5c4e9d64dcf693cab6f399d3@%3Ccommits.zookeeper.apache.org%3EWEB
- https://lists.apache.org/thread.html/r5d8bea8e9d17b6efcf4a0e4e194e91ef46a99f505777a31a60da2b38@%3Cdev.ranger.apache.org%3EWEB
- https://lists.apache.org/thread.html/r65ee95fa09c831843bac81eaa582fdddc2b6119912a72d1c83a9b882@%3Cissues.zookeeper.apache.org%3EWEB
- https://lists.apache.org/thread.html/r6fdd4c61a09a0c89f581b4ddb3dc6f154ab0c705fcfd0a7358b2e4e5@%3Cissues.zookeeper.apache.org%3EWEB
- https://lists.apache.org/thread.html/r7762d69e85c58d6948823424017ef4c08f47de077644277fa18cc116@%3Cdev.ranger.apache.org%3EWEB
- https://lists.apache.org/thread.html/r7e5c10534ed06bf805473ac85e8412fe3908a8fa4cabf5027bf11220@%3Cdev.kafka.apache.org%3EWEB
- https://lists.apache.org/thread.html/r8170007fd9b263d65b37d92a7b5d7bc357aedbb113a32838bc4a9485@%3Cissues.zookeeper.apache.org%3EWEB
- https://lists.apache.org/thread.html/r8e96c340004b7898cad3204ea51280ef6e4b553a684e1452bf1b18b1@%3Cjira.kafka.apache.org%3EWEB
- https://lists.apache.org/thread.html/r94930e39b60fff236160c1c4110fe884dc093044b067aa5fc98d7ee1@%3Cdev.ranger.apache.org%3EWEB
- https://lists.apache.org/thread.html/r9e59ebaf76fd00b2fa3ff5ebf18fe075ca9f4376216612c696f76718@%3Cdev.ranger.apache.org%3EWEB
- https://lists.apache.org/thread.html/r9ecf211c22760b00967ebe158c6ed7dba9142078e2a630ab8904a5b7@%3Cdev.zookeeper.apache.org%3EWEB
- https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200610-01-fastjason-enWEB
Frequently Asked Questions
- What is CVE-2020-8840?
- Deserialization of Untrusted Data in jackson-databind This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2020-8840?
- CVE-2020-8840 affects com.fasterxml.jackson.core:jackson-databind. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2020-8840 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
9.8
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
GHSA-4w82-r329-3q67
Related CVEs
- CVE-2018-14718CRITICAL
Arbitrary Code Execution in jackson-databind
- CVE-2018-14721CRITICAL
Server-Side Request Forgery (SSRF) in jackson-databind
- CVE-2018-19362CRITICAL
com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data
- CVE-2018-7489CRITICAL
FasterXML jackson-databind allows unauthenticated remote code execution
- CVE-2019-20330CRITICAL
Deserialization of Untrusted Data in jackson-databind
- CVE-2017-15095CRITICAL
jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution
- CVE-2026-54512HIGH
jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation
- CVE-2026-54513HIGH
jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies