CVE-2018-19361: Deserialization of Untrusted Data in jackson-databind
Summary
CVE-2018-19361: Deserialization of Untrusted Data in jackson-databind. Affects com.fasterxml.jackson.core:jackson-databind across 3 version ranges.
>= 2.7.0, < 2.7.9.5
>= 2.8.0, < 2.8.11.3
>= 2.9.0, < 2.9.8
Fixed in 2.7.9.5, 2.8.11.3 or 2.9.8, depending on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2018-19361 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jackson-databind package is a popular Java library used for converting JSON data to Java objects (POJOs) and vice versa. It provides functionalities for reading and writing JSON data. This vulnerability affects versions 2.7.0 to 2.7.9.4, 2.8.0 to 2.8.11.2, and 2.9.0 to 2.9.8 of the package. The vulnerability arises from a failure to block the openjpa class from polymorphic deserialization.
Vulnerability Detail
The vulnerability in jackson-databind allows attackers to exploit the deserialization process and execute arbitrary code by providing malicious input. This can lead to various impacts, including remote code execution, denial of service, or information disclosure. The vulnerability has a CVSS score of 9.8, indicating its critical severity. It is important to note that this vulnerability affects the jackson-databind package and any applications or systems that use it for JSON deserialization.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.7.0, < 2.7.9.52.7.9.5 -
>= 2.8.0, < 2.8.11.32.8.11.3 -
>= 2.9.0, < 2.9.82.9.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading the package is not immediately feasible, a temporary workaround is to disable or block polymorphic deserialization in the application's configuration. This can be achieved by configuring the ObjectMapper with the disableDefaultTyping() method or by using custom TypeResolverBuilder implementations to restrict deserialization to known types.
Conclusion
The CVE-2018-19361 vulnerability in jackson-databind exposes applications to potential remote code execution, denial of service, or information disclosure. It is crucial to upgrade the package to the patched version or apply the recommended workarounds to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
Jackson-databind is a Java library used for converting JSON data to Java objects and vice versa. It is widely used in applications that require JSON serialization and deserialization.
The vulnerability allows attackers to execute arbitrary code during the deserialization process, potentially leading to remote code execution, denial of service, or information disclosure.
Versions 2.7.0 to 2.7.9.4, 2.8.0 to 2.8.11.2, and 2.9.0 to 2.9.8 of jackson-databind are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade the jackson-databind package to version 2.7.9.5, 2.8.11.3, or 2.9.8, depending on the version currently in use.
Yes, a temporary workaround is to disable or block polymorphic deserialization in the application's configuration.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
