CVE-2020-35490: Serialization gadgets exploit in jackson-databind
Summary
CVE-2020-35490: Serialization gadgets exploit in jackson-databind. Affects com.fasterxml.jackson.core:jackson-databind versions >= 2.0.0, < 2.9.10.8. Fixed in 2.9.10.8. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2020-35490 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jackson-databind package is a popular Java library for serializing and deserializing JSON data. It provides functionality for converting Java objects to JSON and vice versa. This vulnerability affects versions 2.x before 2.9.10.8 of the package. The vulnerability arises from mishandling the interaction between serialization gadgets and typing, specifically related to the org.apache.commons.dbcp2.datasources.PerUserPoolDataSource class.
Vulnerability Detail
The vulnerability in jackson-databind allows for potential remote code execution attacks. By exploiting the mishandling of serialization gadgets and typing, an attacker can craft a malicious JSON payload that, when deserialized by an application using the vulnerable version of jackson-databind, can lead to arbitrary code execution. This can result in unauthorized access, data breaches, and other malicious activities.
How To Fix
Minimum fixed version
2.9.10.8
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if upgrading to the latest version is not immediately feasible, developers can consider implementing input validation and sanitization measures to mitigate the risk of deserializing untrusted JSON payloads. This can involve implementing custom deserialization logic or using alternative JSON parsing libraries that are not affected by this vulnerability.
Conclusion
The vulnerability in jackson-databind can lead to remote code execution attacks and should be addressed promptly. Upgrading to the latest secure version or implementing appropriate input validation measures are recommended. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
Jackson-databind is a Java library for serializing and deserializing JSON data. It provides functionality for converting Java objects to JSON and vice versa.
This vulnerability can lead to remote code execution attacks, allowing an attacker to execute arbitrary code on a target system. This can result in unauthorized access, data breaches, and other malicious activities.
To fix this vulnerability, it is recommended to upgrade the jackson-databind package to version 2.9.10.8 or later. This version includes the necessary fixes to address the serialization gadget exploit.
If upgrading to the latest version is not immediately feasible, developers can consider implementing input validation and sanitization measures to mitigate the risk of deserializing untrusted JSON payloads.
Yes, the CVSS score for this vulnerability is 8.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
