CVE-2020-10650 jackson-databind vulnerable to unsafe deserialization
An unauthenticated attacker can execute arbitrary code via unsafe deserialization in the jackson-databind library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-10650?
CVE-2020-10650 is a high-severity unsafe deserialization vulnerability in Debian Debian Linux, published on 26 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.
Weakness: CWE-502
Which versions are affected by CVE-2020-10650?
2 open source packages ship an affected version, including com.fasterxml.jackson.core:jackson-databind. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
com.fasterxml.jackson.core:jackson-databind Maven | All versions | 2.9.10.4 |
com.fasterxml.jackson.core:jackson-databind Maven | All versions | 2.9.10.4 |
Products include Debian Debian Linux, Fasterxml Jackson-Databind, Netapp Active Iq Unified Manager, Oracle Retail Merchandising System, Oracle Retail Sales Audit.
How do I fix CVE-2020-10650?
Upgrade com.fasterxml.jackson.core:jackson-databind to 2.9.10.4 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2020-10650 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-10650 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as CLEANSTART-2026-TI02009, DEBIAN-CVE-2020-10650, DLA-3407-1, GHSA-rpr3-cw39-3pxh, OESA-2021-1129, ROOT-APP-MAVEN-CVE-2020-10650 and 1 more.