Critical Serialization Vulnerability in jackson-databind: CVE-2020-24616
Summary
CVE-2020-24616: FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP). Affects jackson-databind across 2 version ranges.
< 2.12.1-1
>= e8df0987e3034d102ee6d704d30a05a2e3ac7089, < f797abcbf63fa4b5faf20a2f567c29d1e513b450
Fixed in 2.12.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jackson-databind is a core component of the Jackson library, widely used for converting Java objects to and from JSON. It provides powerful data-binding capabilities, allowing developers to easily serialize and deserialize Java objects. However, versions prior to 2.9.10.6 are susceptible to a critical vulnerability that can be exploited through serialization gadgets, potentially leading to unauthorized access or data manipulation.
Vulnerability Detail
CVE-2020-24616 is a vulnerability in FasterXML's jackson-databind library, affecting versions 2.x before 2.9.10.6. The issue arises from improper handling of serialization gadgets in conjunction with typing, specifically related to br.com.anteros.dbcp.AnterosDBCPDataSource. This vulnerability can allow attackers to execute arbitrary code on the server, leading to severe consequences such as data breaches or service disruptions. The CVSS score for this vulnerability is 8.1, indicating a high severity level.
How To Fix
Minimum fixed version
2.12.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider implementing input validation to sanitize any incoming data that may be deserialized. This can help mitigate the risk of exploitation until the package can be updated.
Conclusion
CVE-2020-24616 is a significant vulnerability in the jackson-databind library that poses serious risks to applications using affected versions. It is crucial to upgrade to the fixed version to safeguard against potential exploits. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your software.
See every vulnerability recorded for jackson-databind →
FAQ
CVE-2020-24616 is a critical vulnerability in the jackson-databind library that allows for potential remote code execution through improper handling of serialization.
All versions of jackson-databind 2.x prior to 2.9.10.6 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without signup.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and potential service disruptions.
Yes, implementing input validation to sanitize incoming data can help reduce the risk of exploitation until an upgrade is possible.
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
