CVE-2020-9548: jackson-databind mishandles the interaction between serialization gadgets and typing
Summary
CVE-2020-9548: jackson-databind mishandles the interaction between serialization gadgets and typing. Affects com.fasterxml.jackson.core:jackson-databind across 3 version ranges.
>= 2.0.0, < 2.7.9.7
>= 2.8.0, < 2.8.11.6
>= 2.9.0, < 2.9.10.4
Fixed in 2.7.9.7, 2.8.11.6 or 2.9.10.4, depending on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2020-9548 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jackson-databind package is a part of the FasterXML Jackson library, which provides a set of tools for parsing and generating JSON data in Java. It is widely used in various applications and frameworks for JSON processing. The vulnerability, identified as CVE-2020-9548, affects versions of jackson-databind prior to 2.9.10.4. This vulnerability specifically impacts the interaction between serialization gadgets and typing, with a focus on the br.com.anteros.dbcp.AnterosDBCPConfig class (also known as anteros-core).
Vulnerability Detail
The mishandling of serialization gadgets and typing in jackson-databind can lead to potential security risks. Attackers can exploit this vulnerability to execute arbitrary code during the deserialization process, which may result in remote code execution (RCE) or other malicious activities. This vulnerability has a CVSS score of 9.8, indicating its critical severity. It is categorized under CWE-502, which relates to deserialization of untrusted data. The vulnerability was first published on May 15, 2020, and the last known affected version range is <= 2.9.10.3.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.7.9.72.7.9.7 -
>= 2.8.0, < 2.8.11.62.8.11.6 -
>= 2.9.0, < 2.9.10.42.9.10.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, if upgrading to the fixed version is not immediately feasible, developers can consider implementing input validation and filtering mechanisms to mitigate the risk of deserialization attacks. By carefully validating and sanitizing the input data, it is possible to reduce the likelihood of successful exploitation. However, this workaround may not provide complete protection and should be seen as a temporary solution until the package can be updated.
Conclusion
The CVE-2020-9548 vulnerability in jackson-databind exposes applications to potential remote code execution and other malicious activities. It is critical to promptly update the package to version 2.9.10.4 or higher to mitigate this vulnerability. Regularly monitoring for security updates and following best practices for secure coding are essential to protect against such vulnerabilities. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
Jackson-databind is a component of the FasterXML Jackson library, which provides JSON parsing and generation capabilities in Java. It is widely used in various applications and frameworks for handling JSON data.
This vulnerability allows attackers to execute arbitrary code during the deserialization process, potentially leading to remote code execution (RCE) or other malicious activities.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
To fix this vulnerability, it is recommended to upgrade the jackson-databind package to version 2.9.10.4 or higher. Regularly monitoring for security updates and applying them promptly is also crucial.
Yes, if upgrading to the fixed version is not immediately feasible, implementing input validation and filtering mechanisms can help mitigate the risk of deserialization attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
