CVE-2020-11619

jackson-databind: Serialization gadgets in org.springframework:spring-aop

Published Apr 7, 2020 CVSS 3.1 · 8.1 High EPSS 3.7% KEV · Not listed
Description
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-2179-1 jackson-databind security update
EUVD EUVD EUVD-2020-0399 FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).
Github GHSA Github GHSA GHSA-27xj-rqx5-2255 jackson-databind mishandles the interaction between serialization gadgets and typing
Ubuntu USN Ubuntu USN USN-4813-1 Jackson Databind vulnerabilities
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Oracle agile Product Lifecycle Management
CPEs cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*
Vendors & Products Oracle agile Plm
Oracle agile Product Lifecycle Management
Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Oct 8, 2026, 8:02 PM
Reserved
Apr 7, 2020, 12:00 AM
Status
Analyzed
Published
Apr 7, 2020, 11:15 PM
Modified
Oct 8, 2026, 9:17 PM
Severity
Important
Public date
Apr 6, 2020, 12:00 AM