FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.
{ "github_reviewed_at": "2021-04-08T21:05:38Z", "severity": "HIGH", "nvd_published_at": "2020-12-17T19:15:00Z", "github_reviewed": true, "cwe_ids": [ "CWE-502", "CWE-913" ] }