CVE-2020-25649 XML External Entity (XXE) Injection in Jackson Databind
High 7.5
Published
Updated
Check this codebase for CVE-2020-25649 and fix it if it is affected.
What it is: CVE-2020-25649 is a high-severity vulnerability in Fasterxml Jackson-Databind, published on 3 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2020-25649 in the wild and no public exploit code.
Affected packages and fixed versions:
- com.fasterxml.jackson.core:jackson-databind (Maven): affected from 2.10.0.0; fixed in 2.10.5.1
- com.fasterxml.jackson.core:jackson-databind (Maven): affected from 2.10.0.0; fixed in 2.10.5.1
- com.fasterxml.jackson.core:jackson-databind (Maven): affected from 2.6.0; fixed in 2.6.7.4
- com.fasterxml.jackson.core:jackson-databind (Maven): affected from 2.6.0; fixed in 2.6.7.4
- com.fasterxml.jackson.core:jackson-databind (Maven): affected from 2.7.0.0; fixed in 2.9.10.7
- com.fasterxml.jackson.core:jackson-databind (Maven): affected from 2.7.0.0; fixed in 2.9.10.7
Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.
Reference: https://insights.sbomify.com/CVE-2020-25649/ (Markdown: https://insights.sbomify.com/CVE-2020-25649/index.md)
Attackers can exploit XML external entity flaws in Jackson Databind to read sensitive data or modify integrity, requiring library upgrades.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-25649?
CVE-2020-25649 is a high-severity vulnerability in Fasterxml Jackson-Databind, published on 3 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
Weakness: CWE-611
Which versions are affected by CVE-2020-25649?
6 open source packages ship an affected version, including com.fasterxml.jackson.core:jackson-databind. It affects 39 products.
| Package | Affected | Fixed in |
|---|---|---|
com.fasterxml.jackson.core:jackson-databind Maven | From 2.10.0.0 | 2.10.5.1 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.10.0.0 | 2.10.5.1 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.6.0 | 2.6.7.4 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.6.0 | 2.6.7.4 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.7.0.0 | 2.9.10.7 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.7.0.0 | 2.9.10.7 |
Linux distribution packages (31)
eap7-jackson-databind Red Hat:jboss_enterprise_application_platform:7.3::el6 | All versions | 0:2.10.4-1.redhat_00002.1.el6eap |
eap7-jackson-databind Red Hat:jboss_enterprise_application_platform:7.3::el7 | All versions | 0:2.10.4-1.redhat_00002.1.el7eap |
eap7-jackson-databind Red Hat:jboss_enterprise_application_platform:7.3::el8 | All versions | 0:2.10.4-1.redhat_00002.1.el8eap |
rh-maven35-jackson-databind Red Hat:rhel_software_collections:3::el7 | All versions | 0:2.7.6-2.12.el7 |
rh-maven35-jackson-databind-javadoc Red Hat:rhel_software_collections:3::el7 | All versions | 0:2.7.6-2.12.el7 |
ovirt-engine Red Hat:rhev_manager:4.4:el8 | All versions | 0:4.4.4.5-0.10.el8ev |
ovirt-engine-backend Red Hat:rhev_manager:4.4:el8 | All versions | 0:4.4.4.5-0.10.el8ev |
ovirt-engine-dbscripts Red Hat:rhev_manager:4.4:el8 | All versions | 0:4.4.4.5-0.10.el8ev |
ovirt-engine-dwh Red Hat:rhev_manager:4.4:el8 | All versions | 0:4.4.4.2-1.el8ev |
ovirt-engine-dwh-grafana-integration-setup Red Hat:rhev_manager:4.4:el8 | All versions | 0:4.4.4.2-1.el8ev |
ovirt-engine-dwh-setup Red Hat:rhev_manager:4.4:el8 | All versions | 0:4.4.4.2-1.el8ev |
ovirt-engine-health-check-bundler Red Hat:rhev_manager:4.4:el8 | All versions | 0:4.4.4.5-0.10.el8ev |
ovirt-engine-restapi Red Hat:rhev_manager:4.4:el8 | All versions | 0:4.4.4.5-0.10.el8ev |
ovirt-engine-setup Red Hat:rhev_manager:4.4:el8 | All versions | 0:4.4.4.5-0.10.el8ev |
ovirt-engine-setup-base Red Hat:rhev_manager:4.4:el8 | All versions | 0:4.4.4.5-0.10.el8ev |
ovirt-engine-setup-plugin-cinderlib Red Hat:rhev_manager:4.4:el8 | All versions | 0:4.4.4.5-0.10.el8ev |
ovirt-engine-setup-plugin-imageio Red Hat:rhev_manager:4.4:el8 | All versions | 0:4.4.4.5-0.10.el8ev |
ovirt-engine-setup-plugin-ovirt-engine Red Hat:rhev_manager:4.4:el8 | All versions | 0:4.4.4.5-0.10.el8ev |
ovirt-engine-setup-plugin-ovirt-engine-common Red Hat:rhev_manager:4.4:el8 | All versions | 0:4.4.4.5-0.10.el8ev |
ovirt-engine-setup-plugin-vmconsole-proxy-helper Red Hat:rhev_manager:4.4:el8 | All versions | 0:4.4.4.5-0.10.el8ev |
ovirt-engine-setup-plugin-websocket-proxy Red Hat:rhev_manager:4.4:el8 | All versions | 0:4.4.4.5-0.10.el8ev |
ovirt-engine-tools Red Hat:rhev_manager:4.4:el8 | All versions | 0:4.4.4.5-0.10.el8ev |
ovirt-engine-tools-backup Red Hat:rhev_manager:4.4:el8 | All versions | 0:4.4.4.5-0.10.el8ev |
ovirt-engine-vmconsole-proxy-helper Red Hat:rhev_manager:4.4:el8 | All versions | 0:4.4.4.5-0.10.el8ev |
ovirt-engine-webadmin-portal Red Hat:rhev_manager:4.4:el8 | All versions | 0:4.4.4.5-0.10.el8ev |
ovirt-engine-websocket-proxy Red Hat:rhev_manager:4.4:el8 | All versions | 0:4.4.4.5-0.10.el8ev |
ovirt-web-ui Red Hat:rhev_manager:4.4:el8 | All versions | 0:1.6.6-1.el8ev |
python3-ovirt-engine-lib Red Hat:rhev_manager:4.4:el8 | All versions | 0:4.4.4.5-0.10.el8ev |
rhv-log-collector-analyzer Red Hat:rhev_manager:4.4:el8 | All versions | 0:1.0.6-1.el8ev |
rhvm Red Hat:rhev_manager:4.4:el8 | All versions | 0:4.4.4.5-0.10.el8ev |
vdsm-jsonrpc-java Red Hat:rhev_manager:4.4:el8 | All versions | 0:1.6.0-1.el8ev |
Products include Apache Iotdb, Fasterxml Jackson-Databind, Fedoraproject Fedora, Netapp Oncommand Api Services, Netapp Oncommand Workflow Automation, Netapp Service Level Manager and 33 more.
How do I fix CVE-2020-25649?
Upgrade com.fasterxml.jackson.core:jackson-databind to a fixed version for your release line: 2.10.5.1, 2.6.7.4 or 2.9.10.7.
Is CVE-2020-25649 being exploited?
There is no known exploitation of CVE-2020-25649 in the wild and no public exploit code.
Other vulnerabilities in Fasterxml Jackson-Databind
- CVE-2026-24014 Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write
- CVE-2026-24015 Apache IoTDB: Insecure Default Configuration Vulnerability
- CVE-2026-24713 Apache IoTDB: JEXL Expression Injection Vulnerability
- CVE-2024-24780 Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function
- CVE-2023-46226 Apache IoTDB: Remote Code Execution (RCE) risk via the UDF
Sources
Also known as CLEANSTART-2026-GD39113, DEBIAN-CVE-2020-25649, DLA-2406-1, GHSA-288c-cq4h-88gq, RHSA-2020:4312, RHSA-2020:4401 and 3 more.