CVE-2020-8840: Deserialization of Untrusted Data in jackson-databind
Summary
CVE-2020-8840: Deserialization of Untrusted Data in jackson-databind. Affects com.fasterxml.jackson.core:jackson-databind across 4 version ranges.
>= 2.0.0, < 2.6.7.4
>= 2.7.0, < 2.7.9.7
>= 2.8.0, < 2.8.11.5
>= 2.9.0, < 2.9.10.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2020-8840 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jackson-databind package is a popular Java library used for converting Java objects to JSON and vice versa. It is widely used in various applications and frameworks. However, versions of jackson-databind prior to 2.6.7.4, 2.7.9.7, 2.8.11.5, and 2.9.10.2 are vulnerable to a deserialization vulnerability. This vulnerability can be exploited by an attacker to execute arbitrary code by providing malicious data during deserialization.
Vulnerability Detail
The vulnerability in jackson-databind arises from a lack of certain xbean-reflect/JNDI blocking. This allows an attacker to inject malicious code during the deserialization process, leading to remote code execution. The impact of this vulnerability can be severe, as it allows an attacker to take control of the affected system and perform unauthorized actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.6.7.42.6.7.4 -
>= 2.7.0, < 2.7.9.72.7.9.7 -
>= 2.8.0, < 2.8.11.52.8.11.5 -
>= 2.9.0, < 2.9.10.32.9.10.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately possible, a temporary workaround is to disable deserialization of untrusted data. This can be achieved by configuring the jackson-databind library to use a custom deserialization whitelist or by implementing input validation and sanitization to ensure only trusted data is deserialized.
Conclusion
The vulnerability in jackson-databind can lead to remote code execution, allowing an attacker to take control of the affected system. It is crucial to upgrade to a fixed version of jackson-databind or implement the recommended workarounds to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
The vulnerability allows an attacker to execute arbitrary code remotely, potentially leading to a complete compromise of the affected system.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities in real-time.
While specific exploits for this vulnerability may exist, they have not been disclosed publicly at the time of this report. However, it is important to apply the recommended fixes as soon as possible to mitigate the risk.
Yes, the CVSS score for this vulnerability is 9.8, indicating a critical severity level.
For more information about this vulnerability, you can refer to the GitHub Security Advisory database entry: [link to the vulnerability details]
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
