CVE-2020-36186: 
Java vulnerability analysis and mitigation

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource. This vulnerability was discovered and disclosed in January 2021, affecting multiple versions of the jackson-databind library (NVD).

The vulnerability has a CVSS v3.1 Base Score of 8.1 HIGH with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue stems from improper handling of the interaction between serialization gadgets and typing, specifically related to the org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource class (NVD).

A successful exploitation of this vulnerability could lead to remote code execution, allowing attackers to execute arbitrary code on affected systems. The vulnerability affects confidentiality, integrity, and availability of the system with high severity ratings for each (NVD).

The vulnerability requires network access but is complex to exploit, as indicated by the CVSS metrics showing high attack complexity. No authentication is required to exploit the vulnerability, making it remotely exploitable without credentials (NVD).

The primary mitigation is to upgrade jackson-databind to version 2.9.10.8 or later. For versions 2.10.0 and later, this is not considered a valid CVE as Safe Default Typing is enabled by default. Organizations should avoid enabling default typing and using java.lang.Object as the nominal type of polymorphic values (Jackson CVE Blog).

Multiple vendors and organizations have responded to this vulnerability by releasing security advisories and patches, including NetApp, Oracle, and Debian. NetApp classified this as a critical vulnerability with a CVSS score of 9.8 (NetApp Advisory).