CVE-2018-7489: FasterXML jackson-databind allows unauthenticated remote code execution
Summary
CVE-2018-7489: FasterXML jackson-databind allows unauthenticated remote code execution. Affects com.fasterxml.jackson.core:jackson-databind across 4 version ranges.
< 2.6.7.5
>= 2.7.0, < 2.7.9.3
>= 2.8.0, < 2.8.11.1
>= 2.9.0, < 2.9.5
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2018-7489 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The FasterXML jackson-databind library is a popular Java library used for JSON serialization and deserialization. It provides functionality to convert Java objects to JSON and vice versa. This vulnerability affects versions before 2.8.11.1 and 2.9.x before 2.9.5. The vulnerability allows unauthenticated remote code execution due to an incomplete fix for the CVE-2017-7525 deserialization flaw. Attackers can exploit this vulnerability by sending maliciously crafted JSON input to the readValue method of the ObjectMapper. The vulnerability bypasses a blacklist and can be further exploited if the c3p0 libraries are available in the classpath.
Vulnerability Detail
The vulnerability in FasterXML jackson-databind allows unauthenticated remote code execution. By exploiting the incomplete fix for the CVE-2017-7525 deserialization flaw, an attacker can send specially crafted JSON input to the readValue method of the ObjectMapper. This can lead to the execution of arbitrary code on the target system. The vulnerability is considered critical with a CVSS score of 9.8. It poses a significant risk to applications that use the affected versions of the library.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.7.52.6.7.5 -
>= 2.7.0, < 2.7.9.32.7.9.3 -
>= 2.8.0, < 2.8.11.12.8.11.1 -
>= 2.9.0, < 2.9.52.9.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed version is not immediately feasible, a possible workaround is to remove the c3p0 libraries from the classpath. This can help mitigate the vulnerability by preventing the bypass of the ineffective blacklist. However, this workaround may not be applicable in all scenarios and it is strongly recommended to upgrade to the fixed version as soon as possible.
Conclusion
The vulnerability in FasterXML jackson-databind allows unauthenticated remote code execution and poses a significant risk to applications using the affected versions. It is crucial to upgrade to the fixed version or apply the recommended workaround to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
FasterXML jackson-databind is a Java library used for JSON serialization and deserialization. It provides functionality to convert Java objects to JSON and vice versa.
The vulnerability allows unauthenticated remote code execution, which means that an attacker can execute arbitrary code on the target system without authentication. This can lead to a complete compromise of the system and unauthorized access to sensitive data.
To fix this vulnerability, it is recommended to upgrade to the fixed version of FasterXML jackson-databind. If upgrading is not immediately feasible, removing the c3p0 libraries from the classpath can provide a temporary workaround.
Yes, the CVSS score for this vulnerability is 9.8, which indicates a critical severity level.
You can find more information about this vulnerability in the GitHub Advisory Database. Additionally, you can use Vulert (https://vulert.com) to check if your application is affected by this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
