CVE-2020-36185: 
Java vulnerability analysis and mitigation

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource. The vulnerability was discovered and disclosed in January 2021 and affects multiple versions of the jackson-databind library (NVD).

The vulnerability has a CVSS v3.1 Base Score of 8.1 HIGH with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue is related to the interaction between serialization gadgets and typing specifically in the org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource component (NVD).

If successfully exploited, this vulnerability could lead to remote code execution through deserialization of untrusted data. The vulnerability affects confidentiality, integrity and availability of the system with high severity ratings for all three aspects (NVD).

The vulnerability requires network access but has high attack complexity. No privileges or user interaction are required for exploitation. This vulnerability is a derivative of earlier Apache DBCP 2.x issues (Jackson Issues).

The vulnerability is fixed in jackson-databind version 2.9.10.8. For versions 2.10.0 and later, this is not considered a valid CVE due to Safe Default Typing being enabled by default. Organizations should upgrade to patched versions or implement Safe Default Typing (Jackson Issues).

The vulnerability was reported by Al1ex@knownsec. The jackson-databind maintainers have provided guidance that this issue is not considered valid for Jackson 2.10.0 and later versions due to architectural changes in how typing is handled (Jackson Blog).