CVE-2020-35728: Debian Linux

High severity, CVSS 8.1. EPSS: 12.5% chance of exploitation in the next 30 days.

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

Affected products

  • Debian Debian Linux: version 9.0 only
  • Fasterxml Jackson-Databind: from 2.0.0, before 2.6.7.5 (fixed in 2.6.7.5); from 2.7.0, before 2.9.10.8 (fixed in 2.9.10.8)
  • Netapp Service Level Manager: affected versions not specified
  • Oracle Agile Product Lifecycle Management: version 9.3.6 only
  • Oracle Application Testing Suite: version 13.3.0.1 only
  • Oracle Autovue: version 21.0.2 only
  • Oracle Banking Corporate Lending Process Management: version 14.2 only; version 14.3 only; version 14.5 only
  • Oracle Banking Credit Facilities Process Management: version 14.2 only; version 14.3 only; version 14.5 only
  • Oracle Banking Extensibility Workbench: version 14.2 only; version 14.3 only; version 14.5 only
  • Oracle Banking Supply Chain Finance: version 14.2 only; version 14.3 only; version 14.5 only
  • Oracle Banking Treasury Management: version 14.4 only
  • Oracle Banking Virtual Account Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
  • Oracle Blockchain Platform: up to and including 21.1.2
  • Oracle Commerce Platform: from 11.3.0, up to and including 11.3.2; version 11.2.0 only
  • Oracle Communications Billing And Revenue Management: version 7.5.0.23.0 only; version 12.0.0.3.0 only
  • Oracle Communications Cloud Native Core Policy: version 1.14.0 only
  • Oracle Communications Cloud Native Core Unified Data Repository: version 1.4.0 only
  • Oracle Communications Convergent Charging Controller: version 12.0.4.0.0 only
  • Oracle Communications Diameter Signaling Route: from 8.0.0.0, up to and including 8.5.0.0
  • Oracle Communications Element Manager: from 8.2.0.0, up to and including 8.2.4.0
  • Oracle Communications Evolved Communications Application Server: version 7.1 only
  • Oracle Communications Network Charging And Control: version 12.0.4.0.0 only
  • Oracle Communications Policy Management: version 12.5.0 only
  • Oracle Communications Services Gatekeeper: version 7.0 only
  • Oracle Communications Session Report Manager: from 8.0.0.0, up to and including 8.2.2.1
  • and 15 more

Published 2020-12-27. Last modified 2026-08-25.