Read the docs
TI-2020-15186 Aliases CVE-2020-24750GHSA-qjw2-hr98-qgfh

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between…

Priority MEDIUM 53CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 7 fixed, 8 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.07327 94th percentileScored 2026-11-07
Fix Partial com.fasterxml.jackson.core:jackson-databind (Maven): 2.6.7.5, 2.9.10.6Red Hat: 4 advisoriesRed Hat: 7 fixed, 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.fasterxml.jackson.core:jackson-databind (Maven)2.0 to before 2.6.7.52.6.7.5Patch availableGHSA-qjw2-hr98-qgfh
—com.fasterxml.jackson.core:jackson-databind (Maven)2.7.0 to before 2.9.10.62.9.10.6Patch availableGHSA-qjw2-hr98-qgfh
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.0 to before 2.6.7.5 Fixed in 2.6.7.5 Patch available GHSA-qjw2-hr98-qgfh
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.7.0 to before 2.9.10.6 Fixed in 2.9.10.6 Patch available GHSA-qjw2-hr98-qgfh

CPE configurations NVD · 36

CPEVersionsRoleVendor
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*2.0.0 to before 2.6.7.5; 2.7.0 to before 2.9.10.6VulnerableFasterXML
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*9.3.6VulnerableOracle
cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*13.3.0.1VulnerableOracle
cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:*21.0.2VulnerableOracle
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:*14.2.0VulnerableOracle
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:*14.3.0VulnerableOracle
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:*14.5.0VulnerableOracle
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:*14.2.0VulnerableOracle
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:*14.3.0VulnerableOracle
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:*14.5.0VulnerableOracle
  • cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.6.7.5; 2.7.0 to before 2.9.10.6 Vulnerable ·FasterXML
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* Versions 9.3.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* Versions 13.3.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:* Versions 21.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
Show 26 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:banking_liquidity_management:14.2:*:*:*:*:*:*:*14.2VulnerableOracle
cpe:2.3:a:oracle:banking_liquidity_management:14.3:*:*:*:*:*:*:*14.3VulnerableOracle
cpe:2.3:a:oracle:banking_liquidity_management:14.5:*:*:*:*:*:*:*14.5VulnerableOracle
cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:*14.2.0VulnerableOracle
cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:*14.3.0VulnerableOracle
cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:*14.5.0VulnerableOracle
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*before 21.1.2VulnerableOracle
cpe:2.3:a:oracle:communications_calendar_server:8.0:*:*:*:*:*:*:*8.0VulnerableOracle
cpe:2.3:a:oracle:communications_calendar_server:8.0.0.4.0:*:*:*:*:*:*:*8.0.0.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_contacts_server:8.0:*:*:*:*:*:*:*8.0VulnerableOracle
cpe:2.3:a:oracle:communications_contacts_server:8.0.0.5.0:*:*:*:*:*:*:*8.0.0.5.0VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*8.0.0 – 8.2.2VulnerableOracle
cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*8.2.0 – 8.2.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:*10.0.1.5.0VulnerableOracle
cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*8.1VulnerableOracle
cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3.0:*:*:*:*:*:*:*12.0.0.3.0VulnerableOracle
cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*12.5.0VulnerableOracle
cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.4.0:*:*:*:*:*:*:*12.0.0.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*7.0VulnerableOracle
cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*8.0.0.0 – 8.2.2.1VulnerableOracle
cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*8.2.0 – 8.2.2.1VulnerableOracle
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*7.4.1VulnerableOracle
cpe:2.3:a:oracle:identity_manager_connector:11.1.1.5.0:*:*:*:*:*:*:*11.1.1.5.0VulnerableOracle
cpe:2.3:a:oracle:siebel_core_-_server_framework:*:*:*:*:*:*:*:*up to 21.5VulnerableOracle
cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*up to 21.2VulnerableOracle
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
  • cpe:2.3:a:oracle:banking_liquidity_management:14.2:*:*:*:*:*:*:* Versions 14.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_liquidity_management:14.3:*:*:*:*:*:*:* Versions 14.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_liquidity_management:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* Versions before 21.1.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_calendar_server:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_calendar_server:8.0.0.4.0:*:*:*:*:*:*:* Versions 8.0.0.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_contacts_server:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_contacts_server:8.0.0.5.0:*:*:*:*:*:*:* Versions 8.0.0.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:* Versions 8.2.0 – 8.2.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:* Versions 10.0.1.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:* Versions 12.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.4.0:*:*:*:*:*:*:* Versions 12.0.0.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* Versions 8.0.0.0 – 8.2.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* Versions 8.2.0 – 8.2.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:* Versions 7.4.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:identity_manager_connector:11.1.1.5.0:*:*:*:*:*:*:* Versions 11.1.1.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:siebel_core_-_server_framework:*:*:*:*:*:*:*:* Versions up to 21.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:* Versions up to 21.2 Vulnerable ·Oracle
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-qjw2-hr98-qgfh com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.6.7.5 Advisory →
  • Fix · GHSA-qjw2-hr98-qgfh com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.9.10.6 Advisory →

Red Hat 4 advisories

  • RHSA-2021:1515 Released 2021-05-06 · Red Hat rating Important
    Openshift Logging Bug Fix Release (5.0.3)
    • OpenShift Logging 5.0 openshift-logging/elasticsearch6-rhel8, openshift-logging/eventrouter-rhel8
  • RHSA-2021:1230 Released 2021-04-27 · Red Hat rating Important
    OpenShift Container Platform 4.6.26 security and extras update
    • Red Hat OpenShift Container Platform 4.6 openshift4/ose-logging-elasticsearch6
  • RHSA-2020:5635 Released 2021-02-24 · Red Hat rating Moderate
    OpenShift Container Platform 4.7.0 extras and security update
    • Red Hat OpenShift Container Platform 4.7 openshift4/ose-cluster-capacity, openshift4/ose-cluster-nfd-operator, openshift4/ose-metering-helm-container-rhel8 +2
Show 1 more Red Hat advisories
  • RHSA-2020:4173 Released 2020-10-05 · Red Hat rating Important
    rh-maven35-jackson-databind security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-maven35-jackson-databind-2.7.6-2.11.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.11.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-maven35-jackson-databind-2.7.6-2.11.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.11.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-maven35-jackson-databind-2.7.6-2.11.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.11.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-maven35-jackson-databind-2.7.6-2.11.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.11.el7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
OpenShift Logging 5.0Fixed RHSA-2021:1515
Red Hat OpenShift Container Platform 4.6Fixed RHSA-2021:1230
Red Hat OpenShift Container Platform 4.7Fixed RHSA-2020:5635
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:4173
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2020:4173
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2020:4173
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:4173
Not affected: 22 products
  • A-MQ Clients 2
  • OpenShift Logging 5.0
  • Red Hat Data Grid 8
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 8
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat Integration Service Registry
  • Red Hat JBoss A-MQ 6
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Continuous Delivery
  • Red Hat JBoss Fuse 6
  • Red Hat OpenShift Application Runtimes
  • Red Hat OpenShift Container Platform 4.6
  • Red Hat OpenShift Container Platform 4.7
  • Red Hat Process Automation 7
  • Red Hat Satellite 6
  • Red Hat Single Sign-On 7
  • Red Hat Virtualization 4
  • Red Hat build of Quarkus
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-24750
  2. 2026-10-03 Alias added: GHSA-qjw2-hr98-qgfh
  3. 2026-10-08 CISA SSVC decision points changed

References

Patch 7

Advisory 4

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences