VYPR
← All advisories
High severityNVD Advisory· Published Jan 6, 2021· Updated Aug 4, 2024

CVE-2020-36189

CVE-2020-36189

Description

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

FasterXML jackson-databind before 2.9.10.8 allows remote code execution via a crafted payload using New Relic Agent's embedded logback DriverManagerConnectionSource gadget.

Vulnerability

Overview

CVE-2020-36189 is a deserialization vulnerability in FasterXML jackson-databind versions 2.x prior to 2.9.10.8. The flaw arises from improper handling of the interaction between serialization gadgets and default typing, specifically involving the class com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource from the New Relic Agent library [1][2]. This class, part of an embedded logback-core dependency, can be used as a gadget to achieve remote code execution when deserialized under certain conditions.

Exploitation

Conditions

To exploit this vulnerability, an attacker must be able to send a crafted JSON payload to an application that uses jackson-databind with default typing enabled (or a similar polymorphic type handling configuration) [3]. No authentication is required if the deserialization endpoint is publicly accessible. The attack is network-based and does not require any special privileges. The gadget class is automatically included in applications that use the New Relic Agent, making it a viable target for exploitation [4].

Impact

Successful exploitation allows an attacker to execute arbitrary code on the server, leading to full compromise of the application and potentially the underlying host. This is a critical severity vulnerability, as it can be triggered remotely without authentication. The issue is closely related to CVE-2020-36188, which involves another gadget class from the same library [3].

Mitigation

The vulnerability is fixed in jackson-databind version 2.9.10.8, which adds the DriverManagerConnectionSource class to the default deny list in SubTypeValidator [4]. Users should upgrade to this version or later. If upgrading is not immediately possible, disabling default typing or implementing a custom type validator can mitigate the risk. No workarounds are provided by the vendor beyond upgrading.

References
  1. GitHub - FasterXML/jackson-databind: General data-binding package for Jackson: works on streaming API (core) implementation(s)
  2. NVD - CVE-2020-36189
  3. Block 2 more gadget types (newrelic-agent, CVE-2020-36188/CVE-2020-36189)
  4. Fixed #2996 · FasterXML/jackson-databind@33d96c1

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.fasterxml.jackson.core:jackson-databindMaven
>= 2.7.0, < 2.9.10.82.9.10.8
com.fasterxml.jackson.core:jackson-databindMaven
< 2.6.7.52.6.7.5

Affected products

2

Patches

3
e19c557b7891

[maven-release-plugin] prepare release jackson-databind-2.6.7.5

https://github.com/FasterXML/jackson-databindTatu SalorantaJun 22, 2021via osv
commit
1 file changed · +2 −2
  • pom.xml+2 −2 modified
    @@ -10,7 +10,7 @@
 
   <groupId>com.fasterxml.jackson.core</groupId>
   <artifactId>jackson-databind</artifactId>
-  <version>2.6.7.5-SNAPSHOT</version>
+  <version>2.6.7.5</version>
   <name>jackson-databind</name>
   <packaging>bundle</packaging>
   <description>General data-binding functionality for Jackson: works on core streaming API</description>
@@ -21,7 +21,7 @@
     <connection>scm:git:git@github.com:FasterXML/jackson-databind.git</connection>
     <developerConnection>scm:git:git@github.com:FasterXML/jackson-databind.git</developerConnection>
     <url>http://github.com/FasterXML/jackson-databind</url>
-    <tag>HEAD</tag>
+    <tag>jackson-databind-2.6.7.5</tag>
   </scm>
 
   <properties>
7ae9214c0670

[maven-release-plugin] prepare release jackson-databind-2.9.10.8

https://github.com/FasterXML/jackson-databindTatu SalorantaJan 6, 2021via osv
commit
1 file changed · +2 −2
  • pom.xml+2 −2 modified
    @@ -10,7 +10,7 @@
 
   <groupId>com.fasterxml.jackson.core</groupId>
   <artifactId>jackson-databind</artifactId>
-  <version>2.9.10.8-SNAPSHOT</version>
+  <version>2.9.10.8</version>
   <name>jackson-databind</name>
   <packaging>bundle</packaging>
   <description>General data-binding functionality for Jackson: works on core streaming API</description>
@@ -21,7 +21,7 @@
     <connection>scm:git:git@github.com:FasterXML/jackson-databind.git</connection>
     <developerConnection>scm:git:git@github.com:FasterXML/jackson-databind.git</developerConnection>
     <url>http://github.com/FasterXML/jackson-databind</url>
-    <tag>HEAD</tag>
+    <tag>jackson-databind-2.9.10.8</tag>
   </scm>
 
   <properties>
33d96c13fe18

Fixed #2996

https://github.com/FasterXML/jackson-databindTatu SalorantaDec 26, 2020via ghsa
commit
2 files changed · +7 −0
  • release-notes/VERSION-2.x+2 −0 modified
    @@ -8,6 +8,8 @@ Project: jackson-databind
 
 #2986: Block two more gadget types (commons-dbcp2, CVE-2020-35490/CVE-2020-35491)
  (reported by Al1ex@knownsec)
+#2996: Block 2 more gadget types (placeholder)
+ (reported by Al1ex@knownsec)
 
 2.9.10.7 (02-Dec-2020)
  • src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java+5 −0 modified
    @@ -211,6 +211,11 @@ public class SubTypeValidator
         s.add("org.apache.commons.dbcp2.datasources.PerUserPoolDataSource");
         s.add("org.apache.commons.dbcp2.datasources.SharedPoolDataSource");
 
+        // [databind#2996]: newrelic-agent + embedded-logback-core
+        // (derivative of #2334 and #2389)
+        s.add("com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource");
+        s.add("com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource");
+
         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
     }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

14

News mentions

0

No linked articles in our index yet.