Critical Serialization Vulnerability in jackson-databind: CVE-2020-35490
Summary
CVE-2020-35490: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource. Affects jackson-databind across 2 version ranges.
< 2.12.1-1
>= e8df0987e3034d102ee6d704d30a05a2e3ac7089, < 7ae9214c0670eeb679dd131ab0aee3565cc7af87
Fixed in 2.12.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
jackson-databind is a widely used library in Java for converting Java objects to and from JSON. It is part of the FasterXML project and is integral for applications that require data interchange in JSON format. The library supports various data types and provides features like polymorphic type handling and custom serializers. However, it has been found to be vulnerable to serialization gadgets, which can lead to remote code execution if exploited.
Vulnerability Detail
CVE-2020-35490 is a vulnerability in jackson-databind versions prior to 2.9.10.8. It arises from improper handling of the interaction between serialization gadgets and typing, particularly affecting the org.apache.commons.dbcp2.datasources.PerUserPoolDataSource class. This vulnerability can be exploited by attackers to execute arbitrary code on the server, leading to severe security breaches. The CVSS score for this vulnerability is 8.1, indicating a high severity level.
How To Fix
Minimum fixed version
2.12.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, consider implementing strict input validation and sanitization to mitigate the risk of exploitation. Additionally, avoid using untrusted data sources for deserialization.
Conclusion
CVE-2020-35490 is a critical vulnerability in the jackson-databind library that poses significant security risks. It is essential for developers to upgrade to the latest version to protect their applications from potential exploitation. Utilizing tools like Vulert can aid in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for jackson-databind →
FAQ
CVE-2020-35490 is a vulnerability in the jackson-databind library that allows for remote code execution due to improper handling of serialization gadgets.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to unauthorized remote code execution, compromising the security of the affected application and its data.
Yes, upgrading to jackson-databind version 2.12.1-1 or later will mitigate this vulnerability.
Vulert monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, providing real-time insights into potential security risks.
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
