CVE-2019-10202: Deserialization of Untrusted Data in org.codehaus.jackson:jackson-mapper-asl
Summary
CVE-2019-10202: Deserialization of Untrusted Data in org.codehaus.jackson:jackson-mapper-asl. Affects org.codehaus.jackson:jackson-mapper-asl versions < 1.9.13. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.codehaus.jackson:jackson-mapper-asl package is a part of the Maven ecosystem and is used for data binding between Java objects and JSON data. It provides functionality for serializing and deserializing JSON data. This vulnerability affects versions 0 to 1.9.13 of the package. The vulnerability arises from a series of deserialization vulnerabilities discovered in Codehaus 1.9.x implemented in EAP 7. These vulnerabilities have been previously reported for FasterXML jackson-databind and are now being fixed in this package by implementing a whitelist approach to mitigate current and future vulnerabilities.
Vulnerability Detail
The vulnerability in org.codehaus.jackson:jackson-mapper-asl allows for the deserialization of untrusted data, which can lead to various security issues. Attackers can exploit this vulnerability to execute arbitrary code, perform remote code execution, or cause denial of service. The vulnerability is critical, with a CVSS score of 9.8, indicating a high severity level. The specific vulnerabilities fixed by this CVE include CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, and CVE-2019-12086.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update the package to the latest version that includes the fix.
Conclusion
The org.codehaus.jackson:jackson-mapper-asl package is vulnerable to deserialization of untrusted data, which can lead to various security issues. It is crucial to update the package to the latest version that includes the fix for this CVE to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.codehaus.jackson:jackson-mapper-asl →
FAQ
org.codehaus.jackson:jackson-mapper-asl is a Java library used for data binding between Java objects and JSON data. It provides functionality for serializing and deserializing JSON data.
This vulnerability allows for the deserialization of untrusted data, which can lead to various security issues. Attackers can exploit this vulnerability to execute arbitrary code, perform remote code execution, or cause denial of service.
The CVSS score of this vulnerability is 9.8, indicating a high severity level.
To fix this vulnerability, it is recommended to update the org.codehaus.jackson:jackson-mapper-asl package to a version that includes the fix for this CVE.
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update the package to the latest version that includes the fix.
Related vulnerabilities
Recent vulnerabilities recorded for org.codehaus.jackson:jackson-mapper-asl.
