Remote Code Execution Risk in jackson-databind - CVE-2019-12384
Summary
CVE-2019-12384: FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Affects jackson-databind across 2 version ranges.
< 2.9.8-3
>= e8df0987e3034d102ee6d704d30a05a2e3ac7089, < ec1adf8c72625fd51b30105afad7464c4332d542
Fixed in 2.9.8-3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jackson-databind is a widely used library in Java for converting Java objects to JSON and vice versa. It is part of the FasterXML project and is integral for applications that require data serialization and deserialization. The library's flexibility and ease of use make it a popular choice among developers. However, certain versions of jackson-databind are vulnerable to a polymorphic deserialization issue that can lead to serious security risks.
Vulnerability Detail
CVE-2019-12384 arises from the failure of jackson-databind to block the logback-core class from being deserialized polymorphically. This oversight can allow attackers to exploit the vulnerability, potentially leading to remote code execution depending on the classpath content. The vulnerability affects versions of jackson-databind prior to 2.9.9.1, making it critical for users to ensure they are using a secure version of the library.
How To Fix
Minimum fixed version
2.9.8-3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing a security manager to restrict the classes that can be deserialized. This can help mitigate the risk until a full upgrade can be performed.
Conclusion
CVE-2019-12384 presents a significant risk to applications using vulnerable versions of jackson-databind. It is crucial for developers to upgrade to a secure version to mitigate the risk of remote code execution. Utilizing tools like Vulert can help in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for jackson-databind →
FAQ
CVE-2019-12384 is a vulnerability in jackson-databind that allows for potential remote code execution due to improper handling of polymorphic deserialization.
Versions of jackson-databind prior to 2.9.9.1 are affected by this vulnerability.
You can use tools like Vulert, which monitors open-source vulnerabilities in your software by analyzing your manifest file, such as package-lock.json.
The CVSS score for CVE-2019-12384 is 5.9, indicating a moderate level of risk.
If an immediate upgrade is not feasible, consider implementing a security manager to limit deserialization to safe classes as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
