RHSA-2020:2320HighCVSS 8.1

Red Hat Security Advisory: rh-maven35-jackson-databind security update

Published
May 26, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (2)

CVE-2020-11619 →CVE-2020-11620 →

📋 Description

CVE-2020-11619 — jackson-databind: Serialization gadgets in org.springframework:spring-aop CVE-2020-11620 — jackson-databind: Serialization gadgets in commons-jelly:commons-jelly

🎯 Affected products16

  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-maven35-jackson-databind-0:2.7.6-2.10.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-maven35-jackson-databind-0:2.7.6-2.10.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-maven35-jackson-databind-0:2.7.6-2.10.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-maven35-jackson-databind-0:2.7.6-2.10.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-maven35-jackson-databind-0:2.7.6-2.10.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-maven35-jackson-databind-0:2.7.6-2.10.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-maven35-jackson-databind-0:2.7.6-2.10.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-maven35-jackson-databind-0:2.7.6-2.10.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-maven35-jackson-databind-javadoc-0:2.7.6-2.10.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-maven35-jackson-databind-javadoc-0:2.7.6-2.10.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-maven35-jackson-databind-javadoc-0:2.7.6-2.10.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-maven35-jackson-databind-javadoc-0:2.7.6-2.10.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`

🔗 References (5)