Unsafe Deserialization in jackson-databind

FasterXML jackson-databind 2.x before 2.6.7.5 and from 2.7.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration...

PT-2020-5499 · Fasterxml +2 · Jackson-Databind +2

Name of the Vulnerable Software and Affected Versions: FasterXML jackson-databind versions 2.0.0 through 2.6.7.4 FasterXML jackson-databind versions 2.7.0 through 2.9.10.5 Description: The issue is related to the interaction between serialization gadgets and typing in the FasterXML jackson-databi...