Critical Polymorphic Deserialization Vulnerability in jackson-databind Package
Summary
CVE-2018-19362: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization. Affects jackson-databind across 2 version ranges.
< 2.9.8-1
< 42912cac4753f3f718ece875e4d486f8264c2f2b
Fixed in 2.9.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jackson-databind package is a core component of the FasterXML Jackson library, widely used for converting Java objects to JSON and vice versa. It provides powerful data-binding capabilities, allowing developers to easily serialize and deserialize Java objects. However, this package has been found to be vulnerable to polymorphic deserialization attacks, which can lead to severe security risks if not addressed promptly.
Vulnerability Detail
CVE-2018-19362 is a vulnerability in jackson-databind versions prior to 2.9.8 that allows attackers to exploit the failure to block the jboss-common-core class from polymorphic deserialization. This could lead to unauthorized access, data manipulation, or even remote code execution, depending on the context in which the library is used. The vulnerability arises from the way jackson-databind handles deserialization of untrusted data, making it susceptible to attacks that leverage polymorphic types.
How To Fix
Minimum fixed version
2.9.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to restrict the types of objects that can be deserialized. This can help mitigate the risk of exploitation until the package can be updated.
Conclusion
The CVE-2018-19362 vulnerability in the jackson-databind package poses significant security risks due to its potential for polymorphic deserialization attacks. It is crucial for developers to update to version 2.9.8 or later to mitigate these risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for jackson-databind →
FAQ
CVE-2018-19362 is a vulnerability in the jackson-databind package that allows for polymorphic deserialization attacks, potentially leading to unauthorized access and data manipulation.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The vulnerability can lead to unauthorized access, data manipulation, and potentially remote code execution, depending on how the library is utilized in your application.
Yes, implementing strict input validation to control the types of objects that can be deserialized can help mitigate the risk until an upgrade is possible.
The CVSS score for CVE-2018-19362 is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
