CVE-2018-19360: Deserialization of Untrusted Data in jackson-databind
Summary
CVE-2018-19360: Deserialization of Untrusted Data in jackson-databind due to polymorphic deserialization. Affects com.fasterxml.jackson.core:jackson-databind across 3 version ranges.
>= 2.7.0, < 2.7.9.5
>= 2.8.0, < 2.8.11.3
>= 2.9.0, < 2.9.8
Fixed in 2.7.9.5, 2.8.11.3 or 2.9.8, depending on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2018-19360 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The jackson-databind package is a part of the FasterXML Jackson library, which provides functionality for converting Java objects to JSON and vice versa. It is widely used in Java applications for data serialization and deserialization. This vulnerability affects versions 2.7.0 to 2.9.8 of jackson-databind. The vulnerability arises from a failure to block the axis2-transport-jms class from polymorphic deserialization.
Vulnerability Detail
The vulnerability in jackson-databind allows attackers to exploit the deserialization process by providing untrusted data, which can lead to arbitrary code execution or other unspecified impacts. By leveraging the polymorphic deserialization feature, an attacker can manipulate the deserialization process and execute malicious code. This can result in a wide range of potential consequences, including remote code execution, data tampering, and privilege escalation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.7.0, < 2.7.9.52.7.9.5 -
>= 2.8.0, < 2.8.11.32.8.11.3 -
>= 2.9.0, < 2.9.82.9.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable polymorphic deserialization in the jackson-databind configuration. This can be achieved by configuring the ObjectMapper with the disableDefaultTyping() method. Here's an example of how to apply the workaround:
ObjectMapper mapper = new ObjectMapper().disableDefaultTyping();
However, it is strongly recommended to upgrade to the latest version as soon as possible to fully mitigate the vulnerability.
Conclusion
The CVE-2018-19360 vulnerability in jackson-databind exposes applications to the risk of arbitrary code execution and other potential impacts. It is crucial to upgrade to the latest version of jackson-databind (2.9.8 or later) to mitigate this vulnerability. Regularly updating all dependencies is also essential for maintaining a secure software ecosystem. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
The vulnerability allows attackers to execute arbitrary code or cause other unspecified impacts. This can lead to remote code execution, data tampering, and privilege escalation.
Versions 2.7.0 to 2.9.8 of jackson-databind are affected by this vulnerability.
To fix this vulnerability, upgrade to version 2.9.8 or later of jackson-databind. It is also important to regularly update all dependencies in your project.
Yes, a temporary workaround is to disable polymorphic deserialization in the jackson-databind configuration. However, upgrading to the latest version is strongly recommended.
You can find more information about this vulnerability in the official GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/01/GHSA-f9hv-mg5h-xcw9/GHSA-f9hv-mg5h-xcw9.json
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
