Read the docs
TI-2021-03489 Aliases CVE-2021-20190GHSA-5949-rw7g-wx7w

Deserialization of untrusted data in jackson-databind

Priority MEDIUM 48CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 fixed, 8 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.07573 94th percentileScored 2026-11-07
Fix Partial com.fasterxml.jackson.core:jackson-databind (Maven): 2.9.10.7, 2.6.7.5Red Hat: 2 advisoriesRed Hat: 2 fixed, 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—jackson-databindjackson-databind 2.9.10.7—No fix listedCNA
—com.fasterxml.jackson.core:jackson-databind (Maven)2.7.0 to before 2.9.10.72.9.10.7Patch availableGHSA-5949-rw7g-wx7w
—com.fasterxml.jackson.core:jackson-databind (Maven)before 2.6.7.52.6.7.5Patch availableGHSA-5949-rw7g-wx7w
  • jackson-databind Vendor— Affected jackson-databind 2.9.10.7 Fixed in — No fix listed CNA
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.7.0 to before 2.9.10.7 Fixed in 2.9.10.7 Patch available GHSA-5949-rw7g-wx7w
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected before 2.6.7.5 Fixed in 2.6.7.5 Patch available GHSA-5949-rw7g-wx7w

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*before 2.6.7.5; 2.7.0 to before 2.9.10.7VulnerableFasterXML
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*1.7.0 – 1.12.1VulnerableApache
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:oracle:commerce_experience_manager:11.3.2:*:*:*:*:*:*:*11.3.2VulnerableOracle
cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*11.3.2VulnerableOracle
  • cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions before 2.6.7.5; 2.7.0 to before 2.9.10.7 Vulnerable ·FasterXML
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:* Versions 1.7.0 – 1.12.1 Vulnerable ·Apache
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:oracle:commerce_experience_manager:11.3.2:*:*:*:*:*:*:* Versions 11.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* Versions 11.3.2 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-5949-rw7g-wx7w com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.9.10.7 Advisory →
  • Fix · GHSA-5949-rw7g-wx7w com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.6.7.5 Advisory →

Red Hat 2 advisories

  • RHSA-2021:1515 Released 2021-05-06 · Red Hat rating Important
    Openshift Logging Bug Fix Release (5.0.3)
    • OpenShift Logging 5.0 openshift-logging/elasticsearch6-rhel8, openshift-logging/eventrouter-rhel8
  • RHSA-2021:1230 Released 2021-04-27 · Red Hat rating Important
    OpenShift Container Platform 4.6.26 security and extras update
    • Red Hat OpenShift Container Platform 4.6 openshift4/ose-logging-elasticsearch6

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
OpenShift Logging 5.0Fixed RHSA-2021:1515
Red Hat OpenShift Container Platform 4.6Fixed RHSA-2021:1230
Not affected: 22 products
  • A-MQ Clients 2
  • OpenShift Logging 5.0
  • Red Hat Data Grid 8
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat Integration Service Registry
  • Red Hat JBoss A-MQ 6
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat JBoss Fuse 6
  • Red Hat OpenShift Application Runtimes
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.6
  • Red Hat Process Automation 7
  • Red Hat Satellite 6
  • Red Hat Single Sign-On 7
  • Red Hat build of Quarkus
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-20190
  2. 2026-10-03 Alias added: GHSA-5949-rw7g-wx7w

References

Patch 2

Advisory 5

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences