CVE-2020-14062: Jackson Databind Deserialization Vulnerability
Summary
CVE-2020-14062: Deserialization of untrusted data in Jackson Databind. Affects com.fasterxml.jackson.core:jackson-databind versions >= 2.9.0, < 2.9.10.5. Fixed in 2.9.10.5. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2020-14062 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jackson Databind is a popular Java library used for serializing and deserializing JSON data. It provides a convenient way to convert JSON objects to Java objects and vice versa. This vulnerability affects versions 2.x of the library prior to 2.9.10.5. The vulnerability arises from mishandling the interaction between serialization gadgets and typing, specifically related to the com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2) class.
Vulnerability Detail
The vulnerability allows an attacker to exploit the deserialization process in Jackson Databind by providing untrusted data. By crafting a malicious payload, an attacker can execute arbitrary code on the target system, potentially leading to remote code execution, information disclosure, or other security breaches. The vulnerability is rated as HIGH severity with a CVSS score of 8.1.
How To Fix
Minimum fixed version
2.9.10.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a possible workaround is to disable deserialization of untrusted data altogether. This can be achieved by configuring the Jackson ObjectMapper to ignore unknown properties or by using a custom deserialization process that only allows trusted data to be deserialized.
Conclusion
The CVE-2020-14062 vulnerability in Jackson Databind exposes systems to potential remote code execution and other security risks. It is crucial to upgrade to the fixed version or apply appropriate workarounds to mitigate the vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
Jackson Databind is a Java library used for serializing and deserializing JSON data. It provides a convenient way to convert JSON objects to Java objects and vice versa.
The vulnerability allows an attacker to execute arbitrary code on the target system, potentially leading to remote code execution, information disclosure, or other security breaches.
This vulnerability is rated as HIGH severity with a CVSS score of 8.1.
To fix this vulnerability, it is recommended to upgrade to version 2.9.10.5 or later of the jackson-databind library. Alternatively, you can disable deserialization of untrusted data or implement a custom deserialization process that only allows trusted data to be deserialized.
For more information about this vulnerability, you can refer to the CVE-2020-14062 advisory or visit the Vulert Playground at Vulert Scanner to check if your application is affected.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
