CVE-2020-36180: 
Java vulnerability analysis and mitigation

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS. The vulnerability was disclosed in January 2021 and affects jackson-databind versions from 2.0.0 up to (excluding) 2.9.10.8 (NVD, Debian).

The vulnerability is related to polymorphic type handling and serialization gadgets in jackson-databind. It occurs when polymorphic handling is enabled for properties with nominal type of java.lang.Object or certain permissive interfaces. The vulnerability has a CVSS v3.1 Base Score of 8.1 HIGH with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

A successful exploitation of this vulnerability could lead to remote code execution when processing untrusted JSON input. The vulnerability affects confidentiality, integrity, and availability of the system with high severity when successfully exploited (NetApp Advisory).

The vulnerability requires specific conditions to be exploitable: the application must accept JSON content from untrusted sources, have the vulnerable gadget class in the classpath, and have polymorphic type handling enabled for java.lang.Object or similar permissive types. For Jackson 2.10.0 and later versions, this is not considered a valid CVE due to Safe Default Typing being enabled by default (Jackson Issues).

The primary mitigation is to upgrade jackson-databind to version 2.9.10.8 or later. For versions 2.10.0 and above, the vulnerability is mitigated by default due to Safe Default Typing. Organizations should avoid enabling default typing and using java.lang.Object as the nominal type for polymorphic values. When possible, use explicit typing instead of default typing (Jackson Blog).

The vulnerability was addressed by multiple vendors including Oracle, NetApp, and Debian. Oracle included fixes in their Critical Patch Updates, while NetApp classified it as CRITICAL with a CVSS score of 9.8 (NetApp Advisory).