CVE-2018-1000873: com.fasterxml.jackson.datatype:jackson-datatype-jsr353 - Improper Input Validation
Summary
CVE-2018-1000873: Moderate severity vulnerability that affects com.fasterxml.jackson.datatype:jackson-datatype-jsr353. Affects com.fasterxml.jackson.datatype:jackson-datatype-jsr310 versions < 2.9.8. Fixed in 2.9.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.fasterxml.jackson.datatype:jackson-datatype-jsr353 package is a part of the Jackson-Databind library, which provides data-binding functionality for JSON and other data formats. This package specifically handles the JSR-353 (JSON Processing) API integration with Jackson. It allows users to serialize and deserialize Java objects to and from JSON using the JSR-353 API. However, versions before 2.9.8 of this package contain a vulnerability that can lead to a denial-of-service (DoS) attack.
Vulnerability Detail
The vulnerability in com.fasterxml.jackson.datatype:jackson-datatype-jsr353 (CVE-2018-1000873) is due to improper input validation in the Jackson-Databind library. An attacker can exploit this vulnerability by providing malicious input with very large values in the nanoseconds field of a time value during deserialization. This can cause the victim's application to consume excessive resources, leading to a DoS condition. The vulnerability has a CVSSv3 score of 6.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.9.8
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the package to mitigate the risk.
Conclusion
The com.fasterxml.jackson.datatype:jackson-datatype-jsr353 package before version 2.9.8 is vulnerable to an improper input validation issue that can lead to a denial-of-service (DoS) attack. To mitigate this vulnerability, it is crucial to update the package to version 2.9.8 or later. Vulert's playground (https://vulert.com/scanner) can be used to check if your application is affected by this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.datatype:jackson-datatype-jsr310 →
FAQ
The vulnerability can be exploited to cause a denial-of-service (DoS) condition in the victim's application by consuming excessive resources.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
Yes, the CVSSv3 score for this vulnerability is 6.5, indicating a moderate severity level.
There are no known public exploits for this vulnerability at the moment.
No, the recommended mitigation is to update the com.fasterxml.jackson.datatype:jackson-datatype-jsr353 package to the fixed version.
