CVE-2020-35490: 
Java vulnerability analysis and mitigation

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource. The vulnerability was discovered in December 2020 and affects the jackson-databind library, which is widely used for JSON processing in Java applications (NVD).

The vulnerability is related to polymorphic deserialization in jackson-databind when processing JSON data. It specifically involves the interaction between serialization gadgets and typing mechanisms, particularly affecting the org.apache.commons.dbcp2.datasources.PerUserPoolDataSource class. The vulnerability has a CVSS v3.1 Base Score of 8.1 HIGH with vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

A successful exploitation of this vulnerability could lead to unauthorized disclosure of information, modification of data, or denial of service. The vulnerability affects the confidentiality, integrity, and availability of the system with high severity ratings for each (NVD, NetApp Advisory).

The vulnerability requires network access and high attack complexity to exploit. No authentication is required, and no user interaction is needed for exploitation. The vulnerability is particularly concerning when polymorphic type handling is enabled for properties with nominal type of java.lang.Object or certain tag interfaces (Jackson CVE Blog).

The primary mitigation is to upgrade jackson-databind to version 2.9.10.8 or later. For versions 2.10 and later, this is not considered a valid CVE due to Safe Default Typing being enabled by default. Organizations should avoid enabling default typing and using java.lang.Object as the nominal type for polymorphic values (Jackson CVE Blog).

Multiple vendors and organizations have responded to this vulnerability by releasing security advisories and patches, including NetApp, Oracle, and Debian. Oracle has included fixes for this vulnerability in multiple Critical Patch Updates throughout 2021 (Oracle CPU, Debian Advisory).