CVE-2018-14719: Arbitrary Code Execution in jackson-databind
Summary
CVE-2018-14719: Arbitrary Code Execution in jackson-databind. Affects com.fasterxml.jackson.core:jackson-databind across 3 version ranges.
>= 2.0.0, < 2.7.9.5
>= 2.8.0, < 2.8.11.3
>= 2.9.0, < 2.9.7
Fixed in 2.7.9.5, 2.8.11.3 or 2.9.7, depending on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2018-14719 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jackson-databind package is a popular Java library used for serializing and deserializing JSON data. It provides functionality for converting JSON data to Java objects and vice versa. This vulnerability affects versions 2.x before 2.9.7 of the package. The vulnerability arises from a failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
Vulnerability Detail
The vulnerability in jackson-databind allows remote attackers to execute arbitrary code. By exploiting the flaw in the package, an attacker can inject malicious code during the deserialization process. This can lead to various security risks, including remote code execution, data tampering, and unauthorized access to sensitive information. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.7.9.52.7.9.5 -
>= 2.8.0, < 2.8.11.32.8.11.3 -
>= 2.9.0, < 2.9.72.9.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable polymorphic deserialization in the jackson-databind package. This can be achieved by configuring the package to use a custom TypeResolverBuilder that does not allow polymorphic deserialization. Here is an example of how to disable polymorphic deserialization using a custom TypeResolverBuilder:
ObjectMapper mapper = new ObjectMapper();
mapper.setDefaultTyping(new CustomTypeResolverBuilder(ObjectMapper.DefaultTyping.NON_FINAL) {
@Override
public boolean useForType(JavaType t) {
return false;
}
});
This workaround prevents the exploitation of the vulnerability by blocking the deserialization of the affected classes.
Conclusion
The vulnerability in jackson-databind can lead to arbitrary code execution and other security risks. It is crucial to upgrade to version 2.9.7 or later of the package to mitigate this vulnerability. If immediate upgrading is not possible, disabling polymorphic deserialization can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
This vulnerability allows remote attackers to execute arbitrary code, potentially leading to remote code execution, data tampering, and unauthorized access to sensitive information.
Versions 2.x before 2.9.7 of the jackson-databind package are affected by this vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities in real-time.
Yes, upgrading to version 2.9.7 or later of the jackson-databind package fixes this vulnerability.
Yes, if upgrading to the latest version is not immediately feasible, you can disable polymorphic deserialization in the jackson-databind package as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
