CVE-2020-36182: 
Java vulnerability analysis and mitigation

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS. The vulnerability was discovered and disclosed in January 2021 (NVD).

The vulnerability has a CVSS v3.1 Base Score of 8.1 HIGH with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue involves improper handling of the interaction between serialization gadgets and typing specifically related to the org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS class (NVD).

A successful exploitation of this vulnerability could lead to remote code execution, allowing attackers to execute arbitrary code on affected systems. The vulnerability affects confidentiality, integrity, and availability of the system with high severity (NETAPP).

The vulnerability is remotely exploitable without requiring authentication. However, it requires high attack complexity to exploit. For versions 2.10.0 and later, the vulnerability is mitigated as Safe Default Typing is enabled by default (Jackson Issues).

The vulnerability is fixed in jackson-databind version 2.9.10.8. For versions 2.10.0 and later, the vulnerability is mitigated by default due to Safe Default Typing being enabled. Organizations should upgrade to the patched version or ensure they are using version 2.10.0 or later with Safe Default Typing enabled (Debian Advisory).

The jackson-databind maintainers have provided guidance on the vulnerability through their blog posts and issue trackers. They emphasize that users should not panic but should update to patched versions. For version 2.10 and later users, they clarify that the vulnerability is already mitigated by default security features (Jackson Blog).