CVE-2020-11619: 
Java vulnerability analysis and mitigation

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop). The vulnerability was discovered and disclosed in April 2020 (NVD, Jackson Issue).

The vulnerability is related to the interaction between serialization gadgets and typing in jackson-databind, specifically affecting the org.springframework.aop.config.MethodLocatingFactoryBean class from spring-aop. The vulnerability has been assigned a CVSS v3.1 base score of 8.1 (HIGH) with the vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

Successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). The vulnerability has been rated as CRITICAL with a CVSS score of 9.8 in some contexts (NetApp Advisory).

The vulnerability requires network access and is exploitable without authentication, though it requires high attack complexity. The issue affects applications using jackson-databind versions prior to 2.9.10.4 that have polymorphic deserialization enabled (Jackson Blog).

The primary mitigation is to upgrade jackson-databind to version 2.9.10.4 or later. For versions 2.10 and above, the vulnerability is mitigated by default as Safe Default Typing is enabled. Organizations should avoid enabling default typing when possible and use explicit typing instead (Jackson Issue).

The vulnerability was reported by Bui Duong from Viettel Cyber Security. Multiple vendors including Oracle, NetApp, and Debian have issued advisories and patches for their affected products (Debian Advisory).