CVE-2020-36189: Debian Linux

High severity, CVSS 8.1. EPSS: 4% chance of exploitation in the next 30 days.

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

Affected products

  • Debian Debian Linux: version 9.0 only
  • Fasterxml Jackson-Databind: from 2.0.0, before 2.6.7.5 (fixed in 2.6.7.5); from 2.7.0, before 2.9.10.8 (fixed in 2.9.10.8)
  • Netapp Cloud Backup: affected versions not specified
  • Netapp Service Level Manager: affected versions not specified
  • Oracle Agile Product Lifecycle Management: version 9.3.6 only
  • Oracle Application Testing Suite: version 13.3.0.1 only
  • Oracle Autovue For Agile Product Lifecycle Management: version 21.0.2 only
  • Oracle Banking Platform: version 2.6.2 only; version 2.7.0 only; version 2.7.1 only; version 2.8.0 only; version 2.9.0 only; version 2.10.0 only
  • Oracle Banking Treasury Management: version 14.4 only
  • Oracle Banking Virtual Account Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
  • Oracle Blockchain Platform: up to and including 21.1.2
  • Oracle Commerce Platform: from 11.3.0, up to and including 11.3.2; version 11.2.0 only
  • Oracle Communications Billing And Revenue Management: version 7.5.0.23.0 only; version 12.0.0.3.0 only
  • Oracle Communications Cloud Native Core Policy: version 1.14.0 only
  • Oracle Communications Cloud Native Core Unified Data Repository: version 1.4.0 only
  • Oracle Communications Convergent Charging Controller: version 12.0.4.0.0 only
  • Oracle Communications Diameter Signaling Router: from 8.0.0, up to and including 8.5.0
  • Oracle Communications Evolved Communications Application Server: version 7.1 only
  • Oracle Communications Instant Messaging Server: version 10.0.1.5.0 only
  • Oracle Communications Interactive Session Recorder: version 6.3 only; version 6.4 only
  • Oracle Communications Messaging Server: version 8.0.2 only; version 8.1 only
  • Oracle Communications Network Charging And Control: version 12.0.4.0.0 only
  • Oracle Communications Offline Mediation Controller: version 12.0.0.3 only
  • Oracle Communications Pricing Design Center: version 12.0.0.4.0 only
  • Oracle Communications Services Gatekeeper: version 7.0 only
  • and 15 more

Published 2021-01-06. Last modified 2026-10-08.