CVE-2020-35728: 
Java vulnerability analysis and mitigation

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl). The vulnerability was discovered in December 2020 and affects systems using jackson-databind versions prior to 2.9.10.8 (GitHub Issue).

The vulnerability is related to the interaction between serialization gadgets and typing in jackson-databind, specifically involving the com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool class. The vulnerability has a CVSS v3.1 Base Score of 8.1 HIGH with the vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

Successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS) (NetApp Advisory).

The vulnerability requires polymorphic type handling to be enabled and requires the affected class to be present in the classpath. For Jackson 2.10.0 and later versions, this is not considered a valid CVE due to Safe Default Typing being enabled by default (Jackson Blog).

The vulnerability is fixed in jackson-databind version 2.9.10.8. Users should upgrade to this version or later. For Jackson 2.10.0 and later versions, Safe Default Typing is enabled by default which mitigates this vulnerability. Organizations using affected versions should upgrade to a patched version (GitHub Issue).

The vulnerability was reported by bu5yer of Sangfor FarSight Security Lab. The Jackson project maintainers have addressed this issue as part of their ongoing security improvements, and it has been noted that Jackson 2.10 and later versions are not affected due to Safe Default Typing (Jackson Blog).