VYPR
← All advisories
High severityNVD Advisory· Published Mar 26, 2020· Updated Aug 4, 2024

CVE-2020-10969

CVE-2020-10969

Description

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, allowing remote code execution via javax.swing.JEditorPane.

Vulnerability

Overview

CVE-2020-10969 is a deserialization vulnerability in FasterXML jackson-databind 2.x prior to version 2.9.10.4. The issue arises from the library's improper handling of the interaction between serialization gadgets and type validation, specifically related to the javax.swing.JEditorPane class. This class is a known "gadget" that can be abused when default typing is enabled, allowing an attacker to craft a malicious payload that triggers arbitrary code execution upon deserialization [1][2][3].

Attack

Vector

The exploit requires that the application using jackson-databind has enabled default typing (e.g., ObjectMapper.enableDefaultTyping()) and that the attacker can supply a serialized JSON payload to the deserialization endpoint. No authentication is needed if the endpoint is publicly accessible. The attacker crafts a JSON object that leverages the javax.swing.JEditorPane gadget chain, which, when deserialized, can lead to the execution of arbitrary commands on the server or client [2][3].

Impact

Successful exploitation can lead to remote code execution in the context of the application, potentially allowing the attacker to take full control of the affected system, exfiltrate data, or perform other malicious activities. The vulnerability is rated with a CVSS v3.1 base score of 9.8 (Critical), indicating the highest severity due to the network attack vector, low complexity, and no required privileges [2].

Mitigation

The fix was implemented in jackson-databind version 2.9.10.4 by adding javax.swing.JEditorPane to the blocklist of dangerous classes in the SubTypeValidator [4]. Users are strongly advised to upgrade to this or a later version. For those unable to upgrade, disabling default typing or applying a custom deserialization safety checker can serve as a workaround [1][2].

References
  1. GitHub - FasterXML/jackson-databind: General data-binding package for Jackson: works on streaming API (core) implementation(s)
  2. NVD - CVE-2020-10969
  3. Block one more gadget type (javax.swing, CVE-2020-10969)
  4. Fix #2642 · FasterXML/jackson-databind@6ba4845

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.fasterxml.jackson.core:jackson-databindMaven
>= 2.9.0, < 2.9.10.42.9.10.4

Affected products

4

Patches

1
6ba484579849

Fix #2642

https://github.com/FasterXML/jackson-databindTatu SalorantaMar 4, 2020via ghsa
commit
2 files changed · +7 −2
  • release-notes/VERSION+4 −2 modified
    @@ -6,10 +6,12 @@ Project: jackson-databind
 
 2.7.9.7 (not yet released)
 
-#2631: Block one more gadget type (shaded-hikari-config, CVE-to-be-allocated)
+#2631: Block one more gadget type (shaded-hikari-config, CVE-2020-9546)
  (reported by threedr3am & LFY)
-#2634: Block two more gadget types (ibatis-sqlmap, anteros-core; CVE-to-be-allocated)
+#2634: Block two more gadget types (ibatis-sqlmap, anteros-core; CVE-2020-9547 / CVE-2020-9548)
  (reported by threedr3am & V1ZkRA)
+#2642: Block one more gadget type (javax.swing, CVE-to-be-allocated)
+ (reported by threedr3am)
 #2410: Block one more gadget type (HikariCP, CVE-2019-14540)
 #2420: Block one more gadget type (cxf-jax-rs, no CVE allocated yet)
 #2449: Block one more gadget type (HikariCP, CVE-2019-14439 / CVE-2019-16335)
  • src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java+3 −0 modified
    @@ -133,6 +133,9 @@ public class SubTypeValidator
         s.add("com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig");
         s.add("br.com.anteros.dbcp.AnterosDBCPConfig");
 
+        // [databind#2642]: javax.swing (jdk)
+        s.add("javax.swing.JEditorPane");
+
         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
     }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

13

News mentions

0

No linked articles in our index yet.