Critical Serialization Vulnerability in jackson-databind: CVE-2020-36181
Summary
CVE-2020-36181: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS. Affects jackson-databind across 2 version ranges.
< 2.12.1-1
>= e8df0987e3034d102ee6d704d30a05a2e3ac7089, < e19c557b789113f900018208d87446c34ae4fab3
Fixed in 2.12.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jackson-databind is a core component of the FasterXML Jackson library, widely used for converting Java objects to JSON and vice versa. It is integral for applications that require data interchange in a structured format. The library supports various data formats and provides powerful data binding capabilities. However, it has been found to be vulnerable to serialization issues that can be exploited if not addressed promptly.
Vulnerability Detail
CVE-2020-36181 is a critical vulnerability in jackson-databind versions prior to 2.9.10.8. It arises from improper handling of serialization gadgets and typing, particularly in relation to the org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS. This vulnerability can lead to remote code execution, allowing attackers to execute arbitrary code on the server, potentially compromising sensitive data and system integrity.
How To Fix
Minimum fixed version
2.12.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing strict input validation and sanitization to limit the potential impact of this vulnerability. Additionally, avoid using untrusted data sources for serialization to minimize risk.
Conclusion
CVE-2020-36181 is a significant vulnerability in the jackson-databind library that poses a serious risk of remote code execution. It is crucial for developers to upgrade to the patched version to safeguard their applications. Utilizing tools like Vulert can help in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for jackson-databind →
FAQ
CVE-2020-36181 is a vulnerability in jackson-databind that can lead to remote code execution due to improper handling of serialization.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Exploitation of this vulnerability can allow attackers to execute arbitrary code on the server, leading to data breaches and system compromise.
All versions of jackson-databind prior to 2.12.1-1 are affected by this vulnerability.
Yes, implementing strict input validation and avoiding untrusted data sources can help mitigate the risk until an upgrade is possible.
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
