CVE-2020-28491: Denial of Service (DoS) in Jackson Dataformat CBOR
Summary
CVE-2020-28491: Denial of Service (DoS) in Jackson Dataformat CBOR. Affects com.fasterxml.jackson.dataformat:jackson-dataformat-cbor across 2 version ranges.
>= 2.8.0rc1, < 2.11.4
>= 2.12.0rc1, < 2.12.1
Fixed in 2.11.4 or 2.12.1, depending on the release line you run. How to fix ↓
Also tracked for
- jackson-dataformat-cbor · Debian:11
The same CVE-2020-28491 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is com.fasterxml.jackson.dataformat:jackson-dataformat-cbor. It is a library for working with the Concise Binary Object Representation (CBOR) data format in the Jackson data-binding framework. CBOR is a binary serialization format used for efficient data exchange between systems. This vulnerability affects versions 2.8.0-rc1 to 2.11.4 and versions 2.12.0-rc1 to 2.12.1 of the package. The vulnerability allows for unchecked allocation of a byte buffer, leading to a java.lang.OutOfMemoryError exception.
Vulnerability Detail
The vulnerability arises from the unchecked allocation of a byte buffer in the Jackson Dataformat CBOR library. An attacker can exploit this vulnerability by crafting a malicious CBOR payload that triggers the allocation of a large amount of memory, causing the application to exhaust its memory resources and resulting in a denial of service (DoS) condition. This can lead to the unavailability of the affected system or service. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.8.0rc1, < 2.11.42.11.4 -
>= 2.12.0rc1, < 2.12.12.12.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the fixed versions of the package.
Conclusion
In conclusion, the com.fasterxml.jackson.dataformat:jackson-dataformat-cbor package is vulnerable to a denial of service (DoS) attack due to the unchecked allocation of a byte buffer. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions of the package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.dataformat:jackson-dataformat-cbor →
FAQ
The vulnerability can lead to a denial of service (DoS) condition, causing the affected system or service to become unavailable.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file and the playground will analyze it for open-source vulnerabilities in real-time.
Yes, a fix is available. It is recommended to upgrade the com.fasterxml.jackson.dataformat:jackson-dataformat-cbor package to the fixed versions mentioned in the 'how_to_fix' section.
No, there are no known workarounds for this vulnerability. It is necessary to apply the fix by upgrading to the fixed versions of the package.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
