CVE-2020-36179: 
Java vulnerability analysis and mitigation

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS. The vulnerability was discovered and disclosed in January 2021 (NVD).

The vulnerability is related to the interaction between serialization gadgets and typing in jackson-databind, specifically involving the oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS class. The issue has a CVSS v3.1 Base Score of 8.1 (High), with the vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

A successful exploitation of this vulnerability could lead to unauthorized disclosure of information, modification of data, or denial of service. The vulnerability affects the confidentiality, integrity, and availability of the system with high severity (NVD).

The vulnerability is remotely exploitable without requiring authentication. However, it requires high attack complexity to exploit. The vulnerability is particularly concerning when polymorphic type handling is enabled for properties with nominal type of java.lang.Object or certain tag interfaces (Jackson Blog).

The vulnerability has been patched in jackson-databind version 2.9.10.8. Organizations should upgrade to this version or later. For versions 2.10.0 and later, this is not considered a valid CVE due to safe default typing implementation. Additional mitigation strategies include avoiding enabling default typing and avoiding using java.lang.Object as the nominal type of polymorphic values (Jackson Blog).

The vulnerability was addressed by multiple vendors including Oracle, NetApp, and Debian in their security advisories. Oracle included fixes in multiple Critical Patch Updates (Oracle Alert), while NetApp rated it as CRITICAL with a CVSS score of 9.8 (NetApp Advisory).