Read the docs
TI-2020-15088 Aliases CVE-2020-24616GHSA-h3cw-g4mq-c5x2

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between…

Priority MEDIUM 54CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 11 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.07614 94th percentileScored 2026-11-07
Fix Partial com.fasterxml.jackson.core:jackson-databind (Maven): 2.9.10.6Red Hat: 11 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.fasterxml.jackson.core:jackson-databind (Maven)2.0.0 to before 2.9.10.62.9.10.6Patch availableGHSA-h3cw-g4mq-c5x2
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.0.0 to before 2.9.10.6 Fixed in 2.9.10.6 Patch available GHSA-h3cw-g4mq-c5x2

CPE configurations NVD · 33

CPEVersionsRoleVendor
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*2.0.0 to before 2.9.10.6VulnerableFasterXML
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*9.3.6VulnerableOracle
cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*13.3.0.1VulnerableOracle
cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:*21.0.2VulnerableOracle
cpe:2.3:a:oracle:banking_liquidity_management:14.2:*:*:*:*:*:*:*14.2VulnerableOracle
cpe:2.3:a:oracle:banking_liquidity_management:14.3:*:*:*:*:*:*:*14.3VulnerableOracle
cpe:2.3:a:oracle:banking_liquidity_management:14.5:*:*:*:*:*:*:*14.5VulnerableOracle
  • cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.9.10.6 Vulnerable ·FasterXML
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* Versions 9.3.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* Versions 13.3.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:* Versions 21.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_liquidity_management:14.2:*:*:*:*:*:*:* Versions 14.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_liquidity_management:14.3:*:*:*:*:*:*:* Versions 14.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_liquidity_management:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
Show 23 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:banking_supply_chain_finance:14.2:*:*:*:*:*:*:*14.2VulnerableOracle
cpe:2.3:a:oracle:banking_supply_chain_finance:14.3:*:*:*:*:*:*:*14.3VulnerableOracle
cpe:2.3:a:oracle:banking_supply_chain_finance:14.5:*:*:*:*:*:*:*14.5VulnerableOracle
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*before 21.1.2VulnerableOracle
cpe:2.3:a:oracle:communications_calendar_server:8.0:*:*:*:*:*:*:*8.0VulnerableOracle
cpe:2.3:a:oracle:communications_calendar_server:8.0.0.4.0:*:*:*:*:*:*:*8.0.0.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_contacts_server:8.0:*:*:*:*:*:*:*8.0VulnerableOracle
cpe:2.3:a:oracle:communications_contacts_server:8.0.0.5.0:*:*:*:*:*:*:*8.0.0.5.0VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*8.0.0 – 8.2.2VulnerableOracle
cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*8.2.0 – 8.2.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*7.1VulnerableOracle
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:*10.0.1.5.0VulnerableOracle
cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*8.1VulnerableOracle
cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3:*:*:*:*:*:*:*12.0.0.3VulnerableOracle
cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*12.5.0VulnerableOracle
cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.4.0:*:*:*:*:*:*:*12.0.0.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*7.0VulnerableOracle
cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*8.0.0.0 – 8.2.2.1VulnerableOracle
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*7.4.1VulnerableOracle
cpe:2.3:a:oracle:identity_manager_connector:11.1.1.5.0:*:*:*:*:*:*:*11.1.1.5.0VulnerableOracle
cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*up to 21.2VulnerableOracle
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
  • cpe:2.3:a:oracle:banking_supply_chain_finance:14.2:*:*:*:*:*:*:* Versions 14.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_supply_chain_finance:14.3:*:*:*:*:*:*:* Versions 14.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_supply_chain_finance:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* Versions before 21.1.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_calendar_server:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_calendar_server:8.0.0.4.0:*:*:*:*:*:*:* Versions 8.0.0.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_contacts_server:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_contacts_server:8.0.0.5.0:*:*:*:*:*:*:* Versions 8.0.0.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:* Versions 8.2.0 – 8.2.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:* Versions 10.0.1.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3:*:*:*:*:*:*:* Versions 12.0.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:* Versions 12.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.4.0:*:*:*:*:*:*:* Versions 12.0.0.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* Versions 8.0.0.0 – 8.2.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:* Versions 7.4.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:identity_manager_connector:11.1.1.5.0:*:*:*:*:*:*:* Versions 11.1.1.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:* Versions up to 21.2 Vulnerable ·Oracle
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-h3cw-g4mq-c5x2 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.9.10.6 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat JBoss BRMS 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Not affected: 16 products
  • A-MQ Clients 2
  • Red Hat Data Grid 8
  • Red Hat Decision Manager 7
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat Integration Service Registry
  • Red Hat JBoss A-MQ 6
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Continuous Delivery
  • Red Hat JBoss Fuse 6
  • Red Hat OpenShift Application Runtimes
  • Red Hat Process Automation 7
  • Red Hat Satellite 6
  • Red Hat Single Sign-On 7
  • Red Hat build of Quarkus
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-24616
  2. 2026-10-03 Alias added: GHSA-h3cw-g4mq-c5x2
  3. 2026-10-08 CISA SSVC decision points changed

References

Patch 7

Advisory 3

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences