CVE-2020-11619: 
Java vulnerability analysis and mitigation

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop). The vulnerability was discovered and disclosed in April 2020 (NVD, Jackson Issue).

The vulnerability is related to the interaction between serialization gadgets and typing in jackson-databind, specifically affecting the org.springframework.aop.config.MethodLocatingFactoryBean class from spring-aop. The vulnerability has been assigned a CVSS v3.1 base score of 8.1 (HIGH) with the vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

Successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). The vulnerability has been rated as CRITICAL with a CVSS score of 9.8 in some contexts (NetApp Advisory).

The primary mitigation is to upgrade jackson-databind to version 2.9.10.4 or later. For versions 2.10 and above, the vulnerability is mitigated by default as Safe Default Typing is enabled. Organizations should avoid enabling default typing when possible and use explicit typing instead (Jackson Issue).

The vulnerability was reported by Bui Duong from Viettel Cyber Security. Multiple vendors including Oracle, NetApp, and Debian have issued advisories and patches for their affected products (Debian Advisory).