Critical XXE Vulnerability in jackson-databind Package
Summary
CVE-2018-14720: FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization. Affects jackson-databind across 2 version ranges.
< 2.9.8-1
< 87d29af25e82a249ea15858e2d4ecbf64091db44
Fixed in 2.9.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jackson-databind is a widely used Java library that facilitates the serialization and deserialization of Java objects to and from JSON. It is a core component of the Jackson suite, which is known for its performance and ease of use. However, versions prior to 2.9.7 are susceptible to external XML entity (XXE) attacks, which can compromise the security of applications using this library.
Vulnerability Detail
The vulnerability, identified as CVE-2018-14720, arises from the failure of jackson-databind to block certain JDK classes from polymorphic deserialization. This oversight allows attackers to exploit the library by crafting malicious XML input that can lead to unauthorized access to sensitive data or system resources. The potential ramifications include data leakage, system compromise, and the execution of arbitrary code, making it a critical security concern.
How To Fix
Minimum fixed version
2.9.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to sanitize XML inputs and prevent malicious data from being processed. Additionally, configure the XML parser to disable external entity processing, which can help mitigate the risk of XXE attacks.
Conclusion
The CVE-2018-14720 vulnerability in the jackson-databind library poses a significant security risk due to its potential for XXE attacks. It is crucial for developers to upgrade to the fixed version and implement best practices for input validation to safeguard their applications.
See every vulnerability recorded for jackson-databind →
FAQ
CVE-2018-14720 is a vulnerability in the jackson-databind library that allows for external XML entity (XXE) attacks due to improper handling of XML input.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, system compromise, and execution of arbitrary code.
Yes, you should upgrade to jackson-databind version 2.9.8 or later to mitigate this vulnerability.
Vulert monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, providing real-time insights into potential security risks.
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
