Critical Serialization Vulnerability in jackson-databind: CVE-2020-35728
Summary
CVE-2020-35728: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.... Affects jackson-databind across 2 version ranges.
< 2.12.1-1
>= e969f0a31b781f5dfb74e16ddd5ee4b4fa36e8d8, < 7ae9214c0670eeb679dd131ab0aee3565cc7af87
Fixed in 2.12.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jackson-databind is a widely used library in Java for converting Java objects to JSON and vice versa. It is part of the Jackson suite, which is known for its performance and ease of use. This library is integral to many applications that require data interchange in JSON format. However, it has been found to be vulnerable to a critical serialization issue that can lead to remote code execution if exploited.
Vulnerability Detail
CVE-2020-35728 is a vulnerability in FasterXML's jackson-databind library, specifically affecting versions prior to 2.9.10.8. The vulnerability arises from improper handling of serialization gadgets and typing, particularly related to the com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool. This flaw can allow attackers to exploit serialization mechanisms to execute arbitrary code on the server, posing significant security risks to applications using this library.
How To Fix
Minimum fixed version
2.12.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation and sanitization to mitigate the risk of exploitation. Additionally, restrict the use of serialization features in your application until the library can be updated.
Conclusion
CVE-2020-35728 is a critical vulnerability in the jackson-databind library that poses significant risks to applications using affected versions. It is crucial to upgrade to the latest version to ensure security. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for jackson-databind →
FAQ
CVE-2020-35728 is a vulnerability in the jackson-databind library that allows for remote code execution due to improper handling of serialization.
Versions of jackson-databind prior to 2.9.10.8 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing your manifest file like package-lock.json. You can check your application at Vulert Scanner.
Exploitation of this vulnerability can lead to remote code execution, allowing attackers to execute arbitrary code on the server, which can compromise the entire application.
Yes, implementing input validation and sanitization can help mitigate the risk until an upgrade is possible.
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
