CVE-2020-36184: Debian Linux

High severity, CVSS 8.1. EPSS: 8.4% chance of exploitation in the next 30 days.

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.

Affected products

  • Debian Debian Linux: version 9.0 only
  • Fasterxml Jackson-Databind: from 2.0.0, before 2.6.7.5 (fixed in 2.6.7.5); from 2.7.0, before 2.9.10.8 (fixed in 2.9.10.8)
  • Netapp Cloud Backup: affected versions not specified
  • Netapp Service Level Manager: affected versions not specified
  • Oracle Agile Product Lifecycle Management: version 9.3.6 only
  • Oracle Application Testing Suite: version 13.3.0.1 only
  • Oracle Autovue For Agile Product Lifecycle Management: version 21.0.2 only
  • Oracle Banking Corporate Lending Process Management: version 14.2 only; version 14.3 only; version 14.5 only
  • Oracle Banking Credit Facilities Process Management: version 14.2 only; version 14.3 only; version 14.5 only
  • Oracle Banking Extensibility Workbench: version 14.2 only; version 14.3 only; version 14.5 only
  • Oracle Banking Supply Chain Finance: version 14.2 only; version 14.3 only; version 14.5 only
  • Oracle Banking Treasury Management: version 4.4 only
  • Oracle Banking Virtual Account Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
  • Oracle Blockchain Platform: up to and including 21.1.2
  • Oracle Commerce Platform: from 11.3.0, up to and including 11.3.2; version 11.2.0 only
  • Oracle Communications Billing And Revenue Management: version 7.5.0.23.0 only; version 12.0.0.3.0 only
  • Oracle Communications Cloud Native Core Policy: version 1.14.0 only
  • Oracle Communications Cloud Native Core Unified Data Repository: version 1.4.0 only
  • Oracle Communications Convergent Charging Controller: version 12.0.4.0.0 only
  • Oracle Communications Diameter Signaling Route: from 8.0.0.0, up to and including 8.5.0.0
  • Oracle Communications Element Manager: from 8.2.0.0, up to and including 8.2.4.0
  • Oracle Communications Evolved Communications Application Server: version 7.1 only
  • Oracle Communications Instant Messaging Server: version 10.0.1.5.0 only
  • Oracle Communications Network Charging And Control: version 12.0.4.0.0 only
  • Oracle Communications Offline Mediation Controller: version 12.0.0.3 only
  • and 20 more

Published 2021-01-06. Last modified 2026-08-25.