High severity · published Jan 19, 2021
CVE-2021-20190
A flaw was found in jackson-databind before 2.9.10.7
8.1
CVSS
7.6%
EPSS
No
On KEV
Description
A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.6% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
CE
Commerce Experience Manager · Oracle
11.3.2 · source: NVD
CG
Commerce Guided Search · Oracle
11.3.2 · source: NVD
DL
Debian Linux · Debian
9.0 · source: NVD
JA
Jackson-databind · Fasterxml
before 2.6.7.5; 2.7.0 before 2.9.10.7 · source: NVD
NI
Nifi · Apache
1.7.0 through 1.12.1 · source: NVD
OA
Oncommand Api Services · Netapp
All versions, or not specified · source: NVD
OI
Oncommand Insight · Netapp
All versions, or not specified · source: NVD
SL
Service Level Manager · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-20190
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-20190
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1916633
Patch
https://github.com/FasterXML/jackson-databind/issues/2854
Mailing List
https://lists.apache.org/thread.html/r380e9257bacb8551ee6fcf2c59890ae9477b2c78e553fa9ea08e9d9a%40%3Ccommits.nifi.apache.org%3E
Mailing List
https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210219-0008/
Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html
More from Nifi
9.8
CVE-2026-68979
Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates
9.8
CVE-2018-1309
Apache NiFi External XML Entity issue in SplitXML processor
9.8
CVE-2017-15697
A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution
9.8
CVE-2017-5636
In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully…
9.1
CVE-2026-68980
Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion