CVE-2020-9546: 
Java vulnerability analysis and mitigation

CVE-2020-9546 affects FasterXML jackson-databind versions 2.x before 2.9.10.4. The vulnerability involves mishandling of the interaction between serialization gadgets and typing, specifically related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config). The vulnerability was discovered and disclosed in February 2020 (GitHub Issue).

The vulnerability has a CVSS v3.1 Base Score of 9.8 (CRITICAL) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This indicates the vulnerability is network exploitable with low attack complexity, requires no privileges or user interaction, and can result in high impact to confidentiality, integrity and availability (NVD).

Successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS) (NetApp Advisory).

The vulnerability requires polymorphic type handling to be enabled and specifically affects applications that accept untrusted JSON content and have the vulnerable class in the classpath (Jackson Blog).

The vulnerability is fixed in jackson-databind version 2.9.10.4. Users should upgrade to this version or later. For those unable to upgrade immediately, it is recommended to avoid enabling default typing and using java.lang.Object as the nominal type of polymorphic values (Jackson Blog).

Oracle included fixes for this vulnerability in multiple Critical Patch Updates throughout 2020 and 2021, indicating its widespread impact across enterprise software (Oracle CPU, Oracle CPU).