CVE-2019-10172: Improper Restriction of XML External Entity Reference in jackson-mapper-asl
Summary
CVE-2019-10172: Improper Restriction of XML External Entity Reference in jackson-mapper-asl. Affects org.codehaus.jackson:jackson-mapper-asl versions < 1.9.13. No fix is published. How to fix ↓
Also tracked for
- libjackson-json-java · Debian:11
The same CVE-2019-10172 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package under scrutiny is org.codehaus.jackson:jackson-mapper-asl, which is a library for Java that provides functionality for working with JSON data. It is commonly used in various applications and frameworks. This vulnerability affects versions 1.9.x of the library. The vulnerability is related to XML external entity (XXE) vulnerabilities, similar to CVE-2016-3720, but in different classes of the codehaus jackson-mapper-asl library.
Vulnerability Detail
The vulnerability (CVE-2019-10172) in org.codehaus.jackson:jackson-mapper-asl allows for improper restriction of XML external entity references. This can lead to various security issues, including the disclosure of sensitive information, denial of service attacks, and remote code execution. The vulnerability arises due to the lack of proper validation and handling of XML external entities. Attackers can exploit this vulnerability by providing specially crafted XML input to the affected classes in the library.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to upgrade to a version of the jackson-mapper-asl library that is not affected by this issue. In this case, upgrading to a version higher than 1.9.13 will address the vulnerability. Developers should update their project's dependencies to include the fixed version of the library.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the fix by upgrading to a non-affected version of the library.
Conclusion
In conclusion, the vulnerability (CVE-2019-10172) in org.codehaus.jackson:jackson-mapper-asl poses a significant security risk due to the improper restriction of XML external entity references. It is crucial for developers to upgrade to a non-affected version of the library to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.codehaus.jackson:jackson-mapper-asl →
FAQ
org.codehaus.jackson:jackson-mapper-asl is a Java library for working with JSON data. It provides functionality for parsing, generating, and manipulating JSON objects.
An XML external entity (XXE) vulnerability is a type of security vulnerability that allows an attacker to include external entities or files in an XML document, leading to various security risks such as information disclosure, denial of service, or remote code execution.
This vulnerability can be exploited by attackers to disclose sensitive information, perform denial of service attacks, or execute remote code on the affected system.
No, only versions 1.9.x of the library are affected by this vulnerability. It is recommended to upgrade to a non-affected version.
No, there is no known workaround for this vulnerability. It is necessary to apply the fix by upgrading to a non-affected version of the library.
Related vulnerabilities
Recent vulnerabilities recorded for org.codehaus.jackson:jackson-mapper-asl.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.