Critical Vulnerability in jackson-databind: Polymorphic Deserialization Flaw
Summary
CVE-2018-19360: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization. Affects jackson-databind across 2 version ranges.
< 2.9.8-1
< 42912cac4753f3f718ece875e4d486f8264c2f2b
Fixed in 2.9.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jackson-databind is a core component of the Jackson library, widely used for converting Java objects to JSON and vice versa. It provides powerful data-binding capabilities and is integral to many Java applications. However, prior to version 2.9.8, it was susceptible to a vulnerability that allowed attackers to exploit polymorphic deserialization, potentially leading to severe security breaches.
Vulnerability Detail
CVE-2018-19360 affects FasterXML jackson-databind versions 2.x before 2.9.8. The vulnerability arises from the failure to block the axis2-transport-jms class from polymorphic deserialization. This oversight could allow attackers to manipulate the deserialization process, leading to unauthorized access or execution of arbitrary code, thereby compromising the integrity and confidentiality of the affected systems.
How To Fix
Minimum fixed version
2.9.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing strict input validation and sanitization to mitigate the risk of deserialization attacks. Additionally, review your application's use of polymorphic types and restrict the classes that can be deserialized.
Conclusion
CVE-2018-19360 is a critical vulnerability in jackson-databind that poses significant risks to applications using affected versions. Upgrading to version 2.9.8-1 or later is crucial to ensure the security of your systems. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for jackson-databind →
FAQ
CVE-2018-19360 is a vulnerability in jackson-databind that allows attackers to exploit polymorphic deserialization, potentially leading to unauthorized access or execution of arbitrary code.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The CVSS score for CVE-2018-19360 is 9.8, indicating a critical level of severity.
The vulnerability could lead to unauthorized access, data breaches, or execution of malicious code, severely compromising the security of affected applications.
Yes, implementing strict input validation and sanitization can help mitigate the risk of deserialization attacks until an upgrade can be performed.
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
