Critical Serialization Vulnerability in jackson-databind: CVE-2020-36180
Summary
CVE-2020-36180: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS. Affects jackson-databind across 2 version ranges.
< 2.12.1-1
>= e8df0987e3034d102ee6d704d30a05a2e3ac7089, < e19c557b789113f900018208d87446c34ae4fab3
Fixed in 2.12.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jackson-databind is a widely used library in Java for converting Java objects to and from JSON. It is part of the FasterXML project and is essential for applications that require JSON processing. The library is known for its flexibility and ease of use, allowing developers to serialize and deserialize complex data structures seamlessly. However, it has been found to have a critical vulnerability that affects its serialization process, particularly in how it handles typing and serialization gadgets.
Vulnerability Detail
CVE-2020-36180 is a critical vulnerability in jackson-databind versions prior to 2.9.10.8. It arises from improper handling of the interaction between serialization gadgets and typing, specifically related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS. This vulnerability can allow an attacker to exploit the serialization process, potentially leading to remote code execution or data manipulation. The CVSS score for this vulnerability is 8.1, indicating a high severity level that necessitates immediate attention.
How To Fix
Minimum fixed version
2.12.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing input validation and sanitization to mitigate the risk of exploitation. Additionally, restrict the use of serialization features in your application until the upgrade can be performed.
Conclusion
CVE-2020-36180 is a significant vulnerability in the jackson-databind library that can lead to severe security risks if not addressed. Users are strongly encouraged to upgrade to the latest version to mitigate these risks. Regular monitoring of dependencies using tools like Vulert can help maintain application security.
See every vulnerability recorded for jackson-databind →
FAQ
CVE-2020-36180 is a critical vulnerability in the jackson-databind library that affects its serialization process, potentially allowing remote code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2020-36180 is 8.1, indicating a high severity level.
If an immediate upgrade is not possible, implement input validation and restrict serialization features until you can upgrade.
More information about jackson-databind can be found on its official GitHub repository at https://github.com/fasterxml/jackson-databind.
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
