CVE-2020-10673: 
Java vulnerability analysis and mitigation

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus). The vulnerability was disclosed in March 2020 (CVE, MITRE).

The vulnerability exists in the interaction between serialization gadgets and typing functionality in jackson-databind versions prior to 2.9.10.4. The specific issue relates to the handling of com.caucho.config.types.ResourceRef (caucho-quercus) class. Starting from version 2.10 series, the vulnerability is mitigated as Safe Default Typing is enabled by default, but remains an issue when Default Typing is enabled (Debian Tracker).

When successfully exploited, this vulnerability could result in remote command execution on affected systems. The vulnerability has been assigned a HIGH severity rating, particularly affecting systems where jackson-databind is used with default typing enabled (NetApp Advisory).

The vulnerability has been fixed in jackson-databind version 2.9.10.4. Users are strongly recommended to upgrade to this version or later. For version 2.10 and later, the vulnerability is mitigated by default due to Safe Default Typing being enabled by default. Organizations should ensure they are using the latest supported version of the library (Jackson Blog).