CVE-2019-17531: Polymorphic typing issue in com.fasterxml.jackson.core:jackson-databind
Summary
CVE-2019-17531: jackson-databind polymorphic typing issue. Affects com.fasterxml.jackson.core:jackson-databind across 3 version ranges.
< 2.6.7.3
>= 2.7.0, < 2.8.11.5
>= 2.9.0, < 2.9.10.1
Fixed in 2.6.7.3, 2.8.11.5 or 2.9.10.1, depending on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2019-17531 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
com.fasterxml.jackson.core:jackson-databind is a popular Java library used for serializing and deserializing JSON data. It provides functionality to convert Java objects to JSON and vice versa. The library supports various features, including polymorphic typing, which allows the serialization and deserialization of objects with different types. However, a vulnerability has been discovered in versions 2.0.0 through 2.9.10 of jackson-databind that can be exploited when Default Typing is enabled and the apache-log4j-extra (version 1.2.x) jar is present in the classpath. This vulnerability can lead to the execution of malicious payloads if an attacker can provide a JNDI service to access.
Vulnerability Detail
The vulnerability arises due to a Polymorphic Typing issue in jackson-databind. When Default Typing is enabled for an externally exposed JSON endpoint and the apache-log4j-extra jar is present, an attacker can leverage this to execute a malicious payload. By providing a JNDI service, the attacker can exploit the service and potentially gain unauthorized access or perform unauthorized actions. This vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.7.32.6.7.3 -
>= 2.7.0, < 2.8.11.52.8.11.5 -
>= 2.9.0, < 2.9.10.12.9.10.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a possible workaround is to disable Default Typing in the jackson-databind configuration. This can be done by setting the appropriate property to false. However, it is important to note that this workaround may impact the functionality of the application, especially if it relies on polymorphic typing.
Conclusion
The Polymorphic Typing issue in com.fasterxml.jackson.core:jackson-databind (CVE-2019-17531) is a critical vulnerability that can be exploited to execute malicious payloads. It is crucial to upgrade to a fixed version of jackson-databind (2.9.10.1 or later) to mitigate this vulnerability. If immediate upgrade is not possible, disabling Default Typing can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
jackson-databind is a Java library used for converting Java objects to JSON and vice versa. It provides functionality for serialization and deserialization of JSON data.
Default Typing is a feature in jackson-databind that allows automatic inclusion of type information during serialization and deserialization. It enables the handling of polymorphic types.
The vulnerability occurs due to a Polymorphic Typing issue in jackson-databind. When Default Typing is enabled and the apache-log4j-extra jar is present, an attacker can exploit this to execute a malicious payload.
The vulnerability can allow an attacker to execute arbitrary code on the affected system, potentially leading to unauthorized access or unauthorized actions.
Yes, upgrading to version 2.9.10.1 or later of jackson-databind fixes this vulnerability. It is recommended to update the library in your project's dependencies.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
