CVE-2020-35490: Debian Linux

High severity, CVSS 8.1. EPSS: 6.3% chance of exploitation in the next 30 days.

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.

Affected products

  • Debian Debian Linux: version 9.0 only
  • Fasterxml Jackson-Databind: from 2.0.0, before 2.9.10.8 (fixed in 2.9.10.8)
  • Netapp Service Level Manager: affected versions not specified
  • Oracle Agile Product Lifecycle Management: version 9.3.6 only
  • Oracle Application Testing Suite: version 13.3.0.1 only
  • Oracle Autovue For Agile Product Lifecycle Management: version 21.0.2 only
  • Oracle Banking Platform: version 2.6.2 only; version 2.7.0 only; version 2.7.1 only; version 2.8.0 only; version 2.9.0 only; version 2.10.0 only
  • Oracle Banking Treasury Management: version 14.4 only
  • Oracle Banking Virtual Account Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
  • Oracle Blockchain Platform: up to and including 21.1.2
  • Oracle Communications Cloud Native Core Policy: version 1.14.0 only
  • Oracle Communications Cloud Native Core Unified Data Repository: version 1.4.0 only
  • Oracle Communications Diameter Signaling Router: from 8.0.0, up to and including 8.5.0
  • Oracle Communications Evolved Communications Application Server: version 7.1 only
  • Oracle Communications Instant Messaging Server: version 10.0.1.5.0 only
  • Oracle Communications Interactive Session Recorder: version 6.3 only; version 6.4 only
  • Oracle Communications Offline Mediation Controller: version 12.0.0.3 only
  • Oracle Communications Pricing Design Center: version 12.0.0.4.0 only
  • Oracle Communications Services Gatekeeper: version 7.0 only
  • Oracle Communications Unified Inventory Management: version 7.4.1 only
  • Oracle Documaker: version 12.6.3 only; version 12.6.4 only
  • Oracle Insurance Policy Administration j2ee: version 11.2.0 only
  • Oracle Retail Merchandising System: version 15.0.3 only
  • Oracle Retail Xstore Point Of Service: version 16.0.6 only; version 17.0.4 only; version 18.0.3 only; version 19.0.2 only
  • Oracle Webcenter Portal: version 12.2.1.3.0 only; version 12.2.1.4.0 only

Published 2020-12-17. Last modified 2026-10-08.