CVE-2021-20190: 
Java vulnerability analysis and mitigation

A flaw was found in jackson-databind before version 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing, specifically related to javax.swing. The vulnerability was discovered in late 2020 and publicly disclosed on January 19, 2021. This vulnerability affects multiple products that use the jackson-databind library, including various Apache, NetApp, and Oracle products (NVD, MITRE).

The vulnerability is related to unsafe deserialization in jackson-databind when Default Typing is enabled. Starting from the 2.10 series, this issue is mitigated as Safe Default Typing is enabled by default, but it remains an issue when Default Typing is explicitly enabled. The vulnerability has been assigned a CVSS v3.1 base score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (Security Tracker, NVD).

The vulnerability poses significant risks to data confidentiality, integrity, and system availability. When successfully exploited, it could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). The vulnerability is particularly concerning in applications that enable Default Typing and process untrusted input (NetApp Advisory).

The primary mitigation is to upgrade to jackson-databind version 2.9.10.7 or later. For version 2.10.0 and later, the vulnerability is not considered valid due to Safe Default Typing being enabled by default. If upgrading is not immediately possible, recommended workarounds include avoiding deserialization from untrusted sources, disabling Default Typing, and avoiding javax.swing in the classpath (GitHub Issue).

Multiple vendors have responded to this vulnerability by releasing security advisories and patches, including NetApp, Oracle, and Red Hat. Oracle included fixes for this vulnerability in their July 2021 Critical Patch Update. NetApp has provided specific guidance for their affected products, while some products were marked as not affected or received no fixes due to end-of-availability (NetApp Advisory, Oracle CPU).