Critical Serialization Vulnerability in jackson-databind: CVE-2020-10672
Summary
CVE-2020-10672: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jm... Affects jackson-databind across 2 version ranges.
< 2.11.1-1
>= e969f0a31b781f5dfb74e16ddd5ee4b4fa36e8d8, < 1d919062ec351a925a628be2986224383c27f561
Fixed in 2.11.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jackson-databind is a widely used library in Java for converting Java objects to JSON and vice versa. It is part of the FasterXML project and is essential for applications that require data interchange in JSON format. The library supports various data types and provides extensive customization options for serialization and deserialization processes. However, it has been found to be vulnerable to a critical serialization issue that can lead to remote code execution if exploited.
Vulnerability Detail
CVE-2020-10672 is a vulnerability in jackson-databind versions prior to 2.9.10.4. It arises from improper handling of serialization gadgets and typing, specifically related to the org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory. This vulnerability allows attackers to craft malicious input that can lead to arbitrary code execution on the server, posing a significant risk to applications that utilize this library for JSON processing.
How To Fix
Minimum fixed version
2.11.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to sanitize and restrict the types of data that can be deserialized. This can help mitigate the risk of exploitation until an upgrade can be performed.
Conclusion
CVE-2020-10672 represents a significant risk to applications using the jackson-databind library due to its potential for remote code execution. It is crucial for developers to upgrade to the latest version to protect their applications from exploitation. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in real-time.
See every vulnerability recorded for jackson-databind →
FAQ
CVE-2020-10672 is a critical vulnerability in the jackson-databind library that allows for remote code execution due to improper handling of serialization.
Versions of jackson-databind prior to 2.9.10.4 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The CVSS score for CVE-2020-10672 is 8.8, indicating a high severity level.
If an immediate upgrade is not possible, implement input validation to restrict the types of data that can be deserialized as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
