You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
CVE-2020-24750 - High Severity Vulnerability
Vulnerable Library - jackson-databind-2.8.7.jar
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://fasterxml.com/
Path to dependency file: /pom.xml
Path to vulnerable library: /itory/com/fasterxml/jackson/core/jackson-databind/2.8.7/jackson-databind-2.8.7.jar
Dependency Hierarchy:
Found in HEAD commit: 77c895db92c590fab8e72e59e8be84d821d75fb6
Found in base branch: main
Vulnerability Details
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
Publish Date: 2020-09-17
URL: CVE-2020-24750
CVSS 3 Score Details (8.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24616
Release Date: 2020-09-17
Fix Resolution: 2.8.11.6
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: