CVE-2019-12814: FasterXML jackson-databind - Deserialization of untrusted data
Summary
CVE-2019-12814: Deserialization of untrusted data in FasterXML jackson-databind. Affects com.fasterxml.jackson.core:jackson-databind across 4 version ranges.
>= 2.0.0, < 2.6.7.3
>= 2.7.0, < 2.7.9.6
>= 2.8.0, < 2.8.11.4
>= 2.9.0, < 2.9.9.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2019-12814 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FasterXML jackson-databind is a popular Java library used for serializing and deserializing JSON data. It provides a powerful and flexible API for working with JSON objects. However, versions 2.x through 2.9.9 of jackson-databind are vulnerable to a Polymorphic Typing issue. This vulnerability allows an attacker to exploit the deserialization process and read arbitrary local files on the server when Default Typing is enabled for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath.
Vulnerability Detail
The vulnerability arises due to improper handling of untrusted data during deserialization. By sending a specially crafted JSON message, an attacker can trick the application into deserializing it and executing arbitrary code. In this case, the attacker can read arbitrary local files on the server, potentially exposing sensitive information. This vulnerability has a CVSS score of 5.9, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.6.7.32.6.7.3 -
>= 2.7.0, < 2.7.9.62.7.9.6 -
>= 2.8.0, < 2.8.11.42.8.11.4 -
>= 2.9.0, < 2.9.9.12.9.9.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a possible workaround is to disable Default Typing for the affected JSON endpoint. This can be done by configuring the ObjectMapper to not include type information during serialization and deserialization. Here's an example of how to disable Default Typing:
ObjectMapper mapper = new ObjectMapper();
mapper.disableDefaultTyping();
Conclusion
The Polymorphic Typing issue in FasterXML jackson-databind versions 2.x through 2.9.9 allows an attacker to read arbitrary local files on the server. To mitigate this vulnerability, it is crucial to upgrade to version 2.9.9.1 or later. If immediate upgrade is not possible, disabling Default Typing for the affected JSON endpoint can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
FasterXML jackson-databind is a Java library used for serializing and deserializing JSON data. It provides a flexible and efficient API for working with JSON objects.
The vulnerability allows an attacker to read arbitrary local files on the server. This can potentially expose sensitive information and lead to further attacks.
To fix this vulnerability, upgrade to jackson-databind version 2.9.9.1 or later. Update the dependency in your project's pom.xml file.
Yes, you can disable Default Typing for the affected JSON endpoint. Refer to the provided code example in the 'workaround' section.
The CVSS score of this vulnerability is 5.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
