Critical Vulnerability in jackson-databind: Polymorphic Deserialization Flaw
Summary
CVE-2018-19361: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization. Affects jackson-databind across 2 version ranges.
< 2.9.8-1
< 42912cac4753f3f718ece875e4d486f8264c2f2b
Fixed in 2.9.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jackson-databind is a core component of the FasterXML Jackson library, widely used for converting Java objects to JSON and vice versa. It provides powerful data-binding capabilities, allowing developers to easily serialize and deserialize Java objects. However, prior to version 2.9.8, jackson-databind was susceptible to a vulnerability that could allow attackers to exploit polymorphic deserialization, potentially leading to unauthorized access or data manipulation.
Vulnerability Detail
The vulnerability, identified as CVE-2018-19361, arises from the failure of jackson-databind to block the openjpa class from polymorphic deserialization. This flaw can be exploited by attackers to manipulate the deserialization process, leading to possible arbitrary code execution or data leakage. The severity of this vulnerability is underscored by its CVSS score of 9.8, indicating a critical risk to applications utilizing affected versions of the library.
How To Fix
Minimum fixed version
2.9.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to restrict the types of objects that can be deserialized. This can help mitigate the risk until a proper upgrade is performed.
Conclusion
The CVE-2018-19361 vulnerability in jackson-databind poses a significant risk to applications using affected versions of the library. It is crucial to upgrade to version 2.9.8-1 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for jackson-databind →
FAQ
CVE-2018-19361 is a vulnerability in jackson-databind that allows attackers to exploit polymorphic deserialization, potentially leading to unauthorized access or data manipulation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of CVE-2018-19361 is 9.8, indicating a critical level of risk.
If you cannot upgrade immediately, implement input validation to restrict the types of objects that can be deserialized as a temporary workaround.
More information about jackson-databind can be found on its official GitHub repository at https://github.com/fasterxml/jackson-databind.
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
