Critical Deserialization Vulnerability in jackson-databind: Potential Code Execution Risk
Summary
CVE-2017-7525: A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to t... Affects jackson-databind across 2 version ranges.
< 2.9.1-1
< f7abd682a7b2f8145ecff1c4e205073949f1e623
Fixed in 2.9.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jackson-databind is a widely used library in Java for converting Java objects to and from JSON. It is part of the Jackson suite, which provides powerful data-binding capabilities. The library is integral for applications that require JSON processing, making it a critical component in many Java-based systems. However, certain versions of jackson-databind are vulnerable to a deserialization flaw that can be exploited by attackers.
Vulnerability Detail
A deserialization flaw was discovered in jackson-databind versions prior to 2.6.7.1, 2.7.9.1, and 2.8.9. This vulnerability allows an unauthenticated user to execute arbitrary code by sending maliciously crafted input to the readValue method of the ObjectMapper. The flaw arises from improper handling of input data, which can lead to severe security implications, including unauthorized access and data manipulation.
How To Fix
Minimum fixed version
2.9.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to filter out potentially malicious data before it reaches the ObjectMapper. This can help mitigate the risk until a proper update is applied.
Conclusion
The deserialization vulnerability in jackson-databind poses a significant risk to applications relying on this library for JSON processing. It is crucial to update to the latest versions to mitigate potential security threats. Regular monitoring and vulnerability assessments are recommended to maintain application security.
See every vulnerability recorded for jackson-databind →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of risk.
Versions of jackson-databind before 2.6.7.1, 2.7.9.1, and 2.8.9 are affected by this vulnerability.
If left unaddressed, this vulnerability can allow attackers to execute arbitrary code on your server, leading to potential data breaches and system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, providing real-time insights.
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
