jackson-databind: Serialization gadgets in com.pastdev.httpcomponents.configuration.JndiConfiguration
Published Sep 17, 2020
8.1
HIGHCVSS 3.1
EPSS 7.33%
Description
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
Affected products
No data.
Configuration 1
- ≥ 2.0.0 · < 2.6.7.5
- ≥ 2.7.0 · < 2.9.10.6
Configuration 2
- 9.3.6
- 13.3.0.1
- 21.0.2
- 14.2.0
- 14.3.0
- 14.5.0
- 14.2.0
- 14.3.0
- 14.5.0
- 14.2
- 14.3
- 14.5
- 14.2.0
- 14.3.0
- 14.5.0
- < 21.1.2
- 8.0
- 8.0.0.4.0
- 8.0
- 8.0.0.5.0
- ≥ 8.0.0 · ≤ 8.2.2
- ≥ 8.2.0 · ≤ 8.2.4.0
- 10.0.1.5.0
- 8.1
- 12.0.0.3.0
- 12.5.0
- 12.0.0.4.0
- 7.0
- ≥ 8.0.0.0 · ≤ 8.2.2.1
- ≥ 8.2.0 · ≤ 8.2.2.1
- 7.4.1
- 11.1.1.5.0
- ≤ 21.5
- ≤ 21.2
Configuration 3
- 9.0
No data.
OpenShift Logging 5.0
openshift-logging/elasticsearch6-rhel8:v5.0.3-1
Fixed · RHSA-2021:1515
Red Hat OpenShift Container Platform 4.6
openshift4/ose-logging-elasticsearch6:v4.6.0-202104161407.p0
Fixed · RHSA-2021:1230
Red Hat OpenShift Container Platform 4.7
openshift4/ose-metering-presto:v4.7.0-202102110027.p0
Fixed · RHSA-2020:5635
Red Hat Software Collections for Red Hat Enterprise Linux 7
rh-maven35-jackson-databind-0:2.7.6-2.11.el7
Fixed · RHSA-2020:4173
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
rh-maven35-jackson-databind-0:2.7.6-2.11.el7
Fixed · RHSA-2020:4173
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS
rh-maven35-jackson-databind-0:2.7.6-2.11.el7
Fixed · RHSA-2020:4173
A-MQ Clients 2
jackson-databind
Not affected
Red Hat BPM Suite 6
jackson-databind
Out of support scope
Red Hat Data Grid 8
jackson-databind
Not affected
Red Hat Decision Manager 7
jackson-databind
Not affected
Red Hat Enterprise Linux 8
pki-deps:10.6/jackson-databind
Not affected
Red Hat Fuse 7
jackson-databind
Not affected
Red Hat Integration Camel K 1
jackson-databind
Not affected
Red Hat Integration Service Registry
jackson-databind
Not affected
Red Hat JBoss A-MQ 6
jackson-databind
Not affected
Red Hat JBoss BRMS 6
jackson-databind
Out of support scope
Red Hat JBoss Data Grid 7
jackson-databind
Out of support scope
Red Hat JBoss Data Virtualization 6
jackson-databind
Out of support scope
Red Hat JBoss Enterprise Application Platform 6
jackson-databind
Not affected
Red Hat JBoss Enterprise Application Platform 7
jackson-databind
Not affected
Red Hat JBoss Enterprise Application Platform Continuous Delivery
jackson-databind
Not affected
Red Hat JBoss Fuse 6
jackson-databind
Not affected
Red Hat OpenShift Application Runtimes
jackson-databind
Not affected
Red Hat OpenShift Container Platform 3.11
openshift3/ose-logging-elasticsearch5
Will not fix
Red Hat OpenShift Container Platform 4
openshift4/ose-metering-hadoop
Out of support scope
Red Hat OpenShift Container Platform 4
openshift4/ose-metering-hive
Out of support scope
Red Hat OpenStack Platform 10 (Newton)
opendaylight
Out of support scope
Red Hat OpenStack Platform 13 (Queens)
opendaylight
Will not fix
Red Hat Process Automation 7
jackson-databind
Not affected
Red Hat Satellite 6
candlepin
Not affected
Red Hat Single Sign-On 7
jackson-databind
Not affected
Red Hat Virtualization 4
ovirt-engine
Not affected
Red Hat build of Quarkus
jackson-databind
Not affected
streams for Apache Kafka
jackson-databind
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| OpenShift Logging 5.0 | openshift-logging/elasticsearch6-rhel8:v5.0.3-1 | Fixed | RHSA-2021:1515 |
| Red Hat OpenShift Container Platform 4.6 | openshift4/ose-logging-elasticsearch6:v4.6.0-202104161407.p0 | Fixed | RHSA-2021:1230 |
| Red Hat OpenShift Container Platform 4.7 | openshift4/ose-metering-presto:v4.7.0-202102110027.p0 | Fixed | RHSA-2020:5635 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | rh-maven35-jackson-databind-0:2.7.6-2.11.el7 | Fixed | RHSA-2020:4173 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | rh-maven35-jackson-databind-0:2.7.6-2.11.el7 | Fixed | RHSA-2020:4173 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | rh-maven35-jackson-databind-0:2.7.6-2.11.el7 | Fixed | RHSA-2020:4173 |
| A-MQ Clients 2 | jackson-databind | Not affected | n/a |
| Red Hat BPM Suite 6 | jackson-databind | Out of support scope | n/a |
| Red Hat Data Grid 8 | jackson-databind | Not affected | n/a |
| Red Hat Decision Manager 7 | jackson-databind | Not affected | n/a |
| Red Hat Enterprise Linux 8 | pki-deps:10.6/jackson-databind | Not affected | n/a |
| Red Hat Fuse 7 | jackson-databind | Not affected | n/a |
| Red Hat Integration Camel K 1 | jackson-databind | Not affected | n/a |
| Red Hat Integration Service Registry | jackson-databind | Not affected | n/a |
| Red Hat JBoss A-MQ 6 | jackson-databind | Not affected | n/a |
| Red Hat JBoss BRMS 6 | jackson-databind | Out of support scope | n/a |
| Red Hat JBoss Data Grid 7 | jackson-databind | Out of support scope | n/a |
| Red Hat JBoss Data Virtualization 6 | jackson-databind | Out of support scope | n/a |
| Red Hat JBoss Enterprise Application Platform 6 | jackson-databind | Not affected | n/a |
| Red Hat JBoss Enterprise Application Platform 7 | jackson-databind | Not affected | n/a |
| Red Hat JBoss Enterprise Application Platform Continuous Delivery | jackson-databind | Not affected | n/a |
| Red Hat JBoss Fuse 6 | jackson-databind | Not affected | n/a |
| Red Hat OpenShift Application Runtimes | jackson-databind | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | openshift3/ose-logging-elasticsearch5 | Will not fix | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-metering-hadoop | Out of support scope | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-metering-hive | Out of support scope | n/a |
| Red Hat OpenStack Platform 10 (Newton) | opendaylight | Out of support scope | n/a |
| Red Hat OpenStack Platform 13 (Queens) | opendaylight | Will not fix | n/a |
| Red Hat Process Automation 7 | jackson-databind | Not affected | n/a |
| Red Hat Satellite 6 | candlepin | Not affected | n/a |
| Red Hat Single Sign-On 7 | jackson-databind | Not affected | n/a |
| Red Hat Virtualization 4 | ovirt-engine | Not affected | n/a |
| Red Hat build of Quarkus | jackson-databind | Not affected | n/a |
| streams for Apache Kafka | jackson-databind | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
The following Red Hat products do ship the vulnerable component, but do not enable the unsafe conditions needed to exploit: * JBoss Data Grid 7 * Business Process Management Suite 6 * Business Rules Management Suite 6 * JBoss Data Virtualization 6 * OpenShift Container Platform These products may update the jackson-databind dependency in a future release. The following Red Hat products ship OpenDaylight, which contains the vulnerable jackson-databind, but do not expose jackson-databind in a way that would make it exploitable * Red Hat OpenStack Platform 13 As such, Red Hat will not be providing a fix for OpenDaylight at this time. The following Red Hat products are not affected by this flaw because they use a more recent version of jackson-databind that does not contain the vulnerable code: * CodeReady Studio 12.16.0 * Red Hat Enterprise Linux 8 * Red Hat Enterprise Virtualization * Red Hat Satellite 6
Red Hat mitigation
The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` * avoid com.pastdev.httpcomponents in the classpath
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
No CVSS v3.0 score for this CVE.
AV:N/AC:M/Au:N/C:P/I:P/A:P
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2021–2026- EPSS v1
- EPSS v5
- EPSS v2
- EPSS v3
- EPSS v4
Percentile over time
- EPSS v1
- EPSS v5
- EPSS v2
- EPSS v3
- EPSS v4
Table of values (23 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 7.33% (0.07327) | 94.20th | v5 (v2026.06.15) |
| Jun 15, 2026 | 7.27% (0.07268) | 93.53th | v5 (v2026.06.15) |
| Nov 21, 2025 | 1.48% (0.01480) | 80.39th | v4 (v2025.03.14) |
| Nov 18, 2025 | 31.37% (0.31372) | 96.53th | v4 (v2025.03.14) |
| Mar 30, 2025 | 2.11% (0.02107) | 82.54th | v4 (v2025.03.14) |
| Mar 29, 2025 | 4.78% (0.04782) | 82.05th | v4 (v2025.03.14) |
| Mar 28, 2025 | 2.11% (0.02107) | 82.55th | v4 (v2025.03.14) |
| Mar 27, 2025 | 4.78% (0.04782) | 88.00th | v4 (v2025.03.14) |
| Mar 20, 2025 | 2.11% (0.02107) | 82.62th | v4 (v2025.03.14) |
| Mar 19, 2025 | 4.78% (0.04782) | 88.15th | v4 (v2025.03.14) |
| Mar 17, 2025 | 2.11% (0.02107) | 82.90th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.71% (0.00707) | 81.06th | v3 (v2023.03.01) |
| Feb 8, 2024 | 0.53% (0.00535) | 76.48th | v3 (v2023.03.01) |
| Sep 3, 2023 | 0.53% (0.00535) | 74.24th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.34% (0.00337) | 66.71th | v3 (v2023.03.01) |
| Mar 6, 2023 | 17.17% (0.17166) | 96.23th | v2 (v2022.01.01) |
| Feb 8, 2022 | 17.17% (0.17166) | 93.13th | v2 (v2022.01.01) |
| Feb 4, 2022 | 20.15% (0.20148) | 94.00th | v2 (v2022.01.01) |
| Feb 3, 2022 | 7.85% (0.07855) | 85.01th | v5 (v2026.06.15) |
| Jul 21, 2021 | 7.04% (0.07038) | 0.00th | v1 |
| Jun 15, 2021 | 6.21% (0.06208) | 0.00th | v1 |
| Apr 27, 2021 | 5.36% (0.05363) | 0.00th | v1 |
| Apr 14, 2021 | 4.50% (0.04504) | 0.00th | v1 |
References (17)
- https://access.redhat.com/security/cve/CVE-2020-24750 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1882310 Issue Tracking
- https://github.com/FasterXML/jackson-databind/commit/2118e71325486c68f089a9761c9d8a11b4ddd1cb
- https://github.com/FasterXML/jackson-databind/commit/6cc9f1a1af323cd156f5668a47e43bab324ae16f
- https://github.com/FasterXML/jackson-databind/commit/ad5a630174f08d279504bc51ebba8772fd71b86b x_refsource_CONFIRMPatchThird Party Advisory
- https://github.com/FasterXML/jackson-databind/issues/2798 x_refsource_MISCIssue TrackingPatchThird Party Advisory
- https://github.com/advisories/GHSA-qjw2-hr98-qgfh Advisory
- https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-24750
- https://security.netapp.com/advisory/ntap-20201009-0003/ x_refsource_CONFIRMThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2020-24750
- https://www.oracle.com//security-alerts/cpujul2021.html x_refsource_MISCPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.html x_refsource_MISCPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISCPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpujan2021.html x_refsource_MISCThird Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISCPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISCPatchThird Party Advisory
Change history (0)
No recorded changes yet.