CVE-2021-20190

Katalog CVE

CVSS 8.1 · High EPSS 7,5%

Kerentanan Deserialization of Untrusted Data pada fasterxml jackson-databind, netapp active iq unified manager +7 lainnya. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Rincian

Terbit di NVD

19 Januari 2021

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

7,5% peluang dieksploitasi; lebih tinggi dari 94,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=1916633 issue tracking · patch · advisory pihak ketiga
• https://github.com/FasterXML/jackson-databind/issues/2854 patch · advisory pihak ketiga
• https://lists.apache.org/thread.html/r380e9257bacb8551ee6fcf2c59890ae9477b2c78e553fa9ea08e9d9a%40%3Ccommits.ni... mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210219-0008/ advisory pihak ketiga
• https://www.oracle.com//security-alerts/cpujul2021.html advisory pihak ketiga