RHSA-2020:4173HighCVSS 8.1

Red Hat Security Advisory: rh-maven35-jackson-databind security update

Published
October 5, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (1)

CVE-2020-24750 →

📋 Description

CVE-2020-24750 — jackson-databind: Serialization gadgets in com.pastdev.httpcomponents.configuration.JndiConfiguration

🎯 Affected products16

  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-maven35-jackson-databind-0:2.7.6-2.11.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-maven35-jackson-databind-0:2.7.6-2.11.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-maven35-jackson-databind-0:2.7.6-2.11.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-maven35-jackson-databind-0:2.7.6-2.11.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-maven35-jackson-databind-0:2.7.6-2.11.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-maven35-jackson-databind-0:2.7.6-2.11.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-maven35-jackson-databind-0:2.7.6-2.11.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-maven35-jackson-databind-0:2.7.6-2.11.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-maven35-jackson-databind-javadoc-0:2.7.6-2.11.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-maven35-jackson-databind-javadoc-0:2.7.6-2.11.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-maven35-jackson-databind-javadoc-0:2.7.6-2.11.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-maven35-jackson-databind-javadoc-0:2.7.6-2.11.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` * avoid com.pastdev.httpcomponents in the classpath

🔗 References (4)