CVE-2019-14540: Polymorphic Typing issue in FasterXML jackson-databind
Summary
CVE-2019-14540: Polymorphic Typing issue in FasterXML jackson-databind. Affects com.fasterxml.jackson.core:jackson-databind across 3 version ranges.
< 2.6.7.3
>= 2.7.0, < 2.8.11.5
>= 2.9.0, < 2.9.10
Fixed in 2.6.7.3, 2.8.11.5 or 2.9.10, depending on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2019-14540 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The FasterXML jackson-databind library is a popular Java library for serializing and deserializing JSON data. It provides functionality for converting Java objects to JSON and vice versa. The library is widely used in various applications and frameworks. However, versions before 2.9.10 are vulnerable to a Polymorphic Typing issue.
Vulnerability Detail
The Polymorphic Typing issue in FasterXML jackson-databind allows an attacker to execute arbitrary code by exploiting the deserialization process. This vulnerability arises due to improper handling of polymorphic types during deserialization. An attacker can craft a malicious JSON payload that, when deserialized, can lead to remote code execution. This can result in unauthorized access, data manipulation, or even a complete compromise of the affected system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.7.32.6.7.3 -
>= 2.7.0, < 2.8.11.52.8.11.5 -
>= 2.9.0, < 2.9.102.9.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading the library is not immediately feasible, a possible workaround is to disable polymorphic type handling during deserialization. This can be achieved by configuring the ObjectMapper used for deserialization to disable the 'ACCEPT_EMPTY_STRING_AS_NULL_OBJECT' feature. However, this workaround may not be applicable in all scenarios and upgrading to the fixed version is still the recommended solution.
Conclusion
The Polymorphic Typing issue in FasterXML jackson-databind is a critical vulnerability that can lead to remote code execution. It is crucial to upgrade to version 2.9.10 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
FasterXML jackson-databind is a Java library used for serializing and deserializing JSON data. It provides functionality for converting Java objects to JSON and vice versa.
A Polymorphic Typing issue refers to a vulnerability where the deserialization process does not properly handle polymorphic types. This can allow an attacker to execute arbitrary code by crafting a malicious payload.
The consequences of this vulnerability can be severe. An attacker can exploit it to gain unauthorized access, manipulate data, or even fully compromise the affected system.
To fix this vulnerability, it is recommended to upgrade the FasterXML jackson-databind library to version 2.9.10 or later. This version includes a fix for the Polymorphic Typing issue.
If immediate library upgrade is not possible, a possible workaround is to disable polymorphic type handling during deserialization. However, this workaround may not be applicable in all scenarios and upgrading to the fixed version is still the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
