CVE-2018-5968: Deserialization of Untrusted Data in jackson-databind
Summary
CVE-2018-5968: Deserialization of Untrusted Data in jackson-databind. Affects com.fasterxml.jackson.core:jackson-databind across 3 version ranges.
< 2.7.9.5
>= 2.8.0, < 2.8.11.1
>= 2.9.0, < 2.9.4
Fixed in 2.7.9.5, 2.8.11.1 or 2.9.4, depending on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2018-5968 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jackson-databind package is a popular Java library used for serializing and deserializing JSON data. It provides functionality to convert JSON data to Java objects and vice versa. This vulnerability affects versions 2.8.11 and 2.9.x through 2.9.3 of the package. The vulnerability allows unauthenticated remote code execution due to an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. Attackers can exploit this vulnerability using two different gadgets that bypass a blacklist.
Vulnerability Detail
The vulnerability in jackson-databind allows remote attackers to execute arbitrary code without authentication. It is caused by a flaw in the deserialization process, which can be exploited by sending maliciously crafted JSON data. The incomplete fix for previous deserialization flaws allows attackers to bypass certain security measures. Successful exploitation of this vulnerability can lead to remote code execution, enabling attackers to take control of the affected system. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.1.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.7.9.52.7.9.5 -
>= 2.8.0, < 2.8.11.12.8.11.1 -
>= 2.9.0, < 2.9.42.9.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is advised to disable or restrict the usage of the affected functionality in jackson-databind. This can be done by modifying the application code to avoid deserialization of untrusted data using the vulnerable package. Implementing input validation and sanitization measures can also help mitigate the risk of exploitation.
Conclusion
The vulnerability in jackson-databind allows unauthenticated remote code execution and should be addressed immediately. Upgrading to a fixed version of the package is the recommended solution. Implementing temporary workarounds and following security best practices can help mitigate the risk until the upgrade is completed. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
Jackson-databind is a Java library used for JSON serialization and deserialization. It provides functionality to convert JSON data to Java objects and vice versa.
The vulnerability allows remote attackers to execute arbitrary code without authentication. Successful exploitation can lead to remote code execution and compromise of the affected system.
To fix this vulnerability, upgrade to a fixed version of jackson-databind. For versions 2.8.11, upgrade to a later version that includes the fix. For versions 2.9.x through 2.9.3, upgrade to version 2.9.4 or later.
As a temporary workaround, disable or restrict the usage of the affected functionality in jackson-databind. Implement input validation and sanitization measures to mitigate the risk.
The severity of this vulnerability is rated as HIGH with a CVSS score of 8.1.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
