Critical Remote Code Execution Vulnerability in jackson-databind Package
Summary
CVE-2018-14719: FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization. Affects jackson-databind across 2 version ranges.
< 2.9.8-1
< 87d29af25e82a249ea15858e2d4ecbf64091db44
Fixed in 2.9.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jackson-databind is a widely used Java library for converting Java objects to and from JSON. It is part of the Jackson suite of data-processing tools, which are known for their performance and ease of use. The library supports various data formats and provides features like polymorphic type handling. However, certain versions of jackson-databind are vulnerable to a critical security flaw that allows remote attackers to execute arbitrary code.
Vulnerability Detail
The vulnerability, identified as CVE-2018-14719, arises from the failure to block specific classes (blaze-ds-opt and blaze-ds-core) from polymorphic deserialization. This oversight can be exploited by remote attackers to execute arbitrary code on the server, leading to severe security breaches. The vulnerability affects versions of jackson-databind prior to 2.9.7, and it has a CVSS score of 9.8, indicating a critical level of severity. Attackers can leverage this flaw to gain unauthorized access and control over affected systems.
How To Fix
Minimum fixed version
2.9.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider implementing input validation to restrict the types of objects that can be deserialized. This can help mitigate the risk until a proper upgrade can be performed. Additionally, review your application’s use of jackson-databind to ensure that it does not deserialize untrusted data.
Conclusion
The CVE-2018-14719 vulnerability in jackson-databind poses a significant risk due to its potential for remote code execution. It is crucial for users of the library to upgrade to version 2.9.8-1 or later to mitigate this risk. Additionally, implementing workarounds can provide temporary relief until an upgrade is possible.
See every vulnerability recorded for jackson-databind →
FAQ
CVE-2018-14719 is a vulnerability in the jackson-databind library that allows remote code execution due to improper handling of polymorphic deserialization.
Versions of jackson-databind prior to 2.9.7 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing the manifest file like package-lock.json. Visit Vulert Scanner to check your application without any signup.
Implement input validation to restrict deserialization of untrusted data as a temporary workaround until you can upgrade.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and complete control over the affected system.
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
