CVE-2018-19362: Vulnerability in com.fasterxml.jackson.core:jackson-databind
Summary
CVE-2018-19362: com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data. Affects com.fasterxml.jackson.core:jackson-databind across 4 version ranges.
>= 2.0.0, < 2.6.7.3
>= 2.7.0, < 2.7.9.5
>= 2.8.0, < 2.8.11.3
>= 2.9.0, < 2.9.8
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2018-19362 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
com.fasterxml.jackson.core:jackson-databind is a popular Java library used for data binding between JSON and Java objects. It provides functionality for reading and writing JSON data. This vulnerability affects versions 2.7.0 to 2.9.8 of the library. The vulnerability arises from a failure to block the jboss-common-core class from polymorphic deserialization.
Vulnerability Detail
The vulnerability in com.fasterxml.jackson.core:jackson-databind allows attackers to exploit polymorphic deserialization and potentially have an unspecified impact. By leveraging the jboss-common-core class, attackers can execute arbitrary code or perform other malicious actions. The exact consequences of this vulnerability are not specified, but they can be severe.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.6.7.32.6.7.3 -
>= 2.7.0, < 2.7.9.52.7.9.5 -
>= 2.8.0, < 2.8.11.32.8.11.3 -
>= 2.9.0, < 2.9.82.9.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a workaround is to manually block the jboss-common-core class from polymorphic deserialization. This can be done by configuring the Jackson ObjectMapper to ignore the jboss-common-core class during deserialization. Here's an example of how to do this in Java:
ObjectMapper mapper = new ObjectMapper();
mapper.disableDefaultTyping();
mapper.enableDefaultTypingAsProperty(DefaultTyping.NON_FINAL, "type");
mapper.deactivateDefaultTyping();
Note that this workaround may not provide complete protection and upgrading to the latest version is still recommended.
Conclusion
The vulnerability in com.fasterxml.jackson.core:jackson-databind can have severe consequences, allowing attackers to execute arbitrary code or perform other malicious actions. It is crucial to upgrade to version 2.9.8 or later to mitigate this vulnerability. If immediate upgrading is not possible, manually blocking the jboss-common-core class from polymorphic deserialization can provide temporary protection. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
com.fasterxml.jackson.core:jackson-databind is a Java library used for data binding between JSON and Java objects. It provides functionality for reading and writing JSON data.
Polymorphic deserialization is a feature of Jackson that allows deserializing JSON into different types based on the JSON content. It can be useful for handling complex object hierarchies.
If your application uses com.fasterxml.jackson.core:jackson-databind and is using versions 2.7.0 to 2.9.8, it is vulnerable to this exploit. Attackers can potentially execute arbitrary code or perform other malicious actions.
The CVSS score of this vulnerability is 9.8, indicating a high severity level.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
