CVE-2020-9547: jackson-databind mishandles the interaction between serialization gadgets and typing
Summary
CVE-2020-9547: jackson-databind mishandles the interaction between serialization gadgets and typing. Affects com.fasterxml.jackson.core:jackson-databind across 3 version ranges.
>= 2.0.0, < 2.7.9.7
>= 2.8.0, < 2.8.11.6
>= 2.9.0, < 2.9.10.4
Fixed in 2.7.9.7, 2.8.11.6 or 2.9.10.4, depending on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2020-9547 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package under scrutiny is jackson-databind, which is a part of the FasterXML Jackson library. Jackson-databind is a data-binding package for Jackson that allows developers to convert Java objects to JSON and vice versa. It provides functionality for serializing and deserializing JSON data. This vulnerability affects versions of jackson-databind prior to 2.9.10.4. The vulnerability arises from the mishandling of the interaction between serialization gadgets and typing, specifically related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (also known as ibatis-sqlmap).
Vulnerability Detail
The vulnerability in jackson-databind can lead to remote code execution attacks. By exploiting this vulnerability, an attacker can execute arbitrary code on the target system, potentially leading to a complete compromise of the system. The vulnerability is rated as critical with a CVSS score of 9.8. The vulnerability is caused by the improper handling of serialization gadgets and typing, allowing an attacker to inject malicious code during the deserialization process. This can be exploited by crafting a specially crafted JSON payload that triggers the vulnerability when processed by the affected versions of jackson-databind.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.7.9.72.7.9.7 -
>= 2.8.0, < 2.8.11.62.8.11.6 -
>= 2.9.0, < 2.9.10.42.9.10.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of jackson-databind.
Conclusion
In conclusion, the vulnerability in jackson-databind can lead to remote code execution attacks and should be addressed by upgrading to version 2.9.10.4 or later. It is important to regularly update dependencies to ensure the latest security patches are applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
Jackson-databind is a data-binding package for Jackson that allows developers to convert Java objects to JSON and vice versa.
This vulnerability can lead to remote code execution attacks, potentially resulting in a complete compromise of the target system.
To fix this vulnerability, it is recommended to upgrade to version 2.9.10.4 or later of jackson-databind.
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of jackson-databind.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file and Vulert will analyze it for open-source vulnerabilities, including this one.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
