Critical Serialization Vulnerability in jackson-databind: CVE-2020-36183
Summary
CVE-2020-36183: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool. Affects jackson-databind across 2 version ranges.
< 2.12.1-1
>= e8df0987e3034d102ee6d704d30a05a2e3ac7089, < e19c557b789113f900018208d87446c34ae4fab3
Fixed in 2.12.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jackson-databind is a popular Java library used for converting Java objects to JSON and vice versa. It is widely utilized in various applications for its ease of use and flexibility. However, prior to version 2.9.10.8, it was found to have a vulnerability that could be exploited through serialization gadgets, potentially leading to unauthorized access or data manipulation.
Vulnerability Detail
CVE-2020-36183 is a critical vulnerability in FasterXML's jackson-databind library, affecting versions 2.x before 2.9.10.8. The vulnerability arises from improper handling of serialization gadgets and typing, particularly related to the org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool. This flaw can allow attackers to execute arbitrary code, leading to severe consequences such as data breaches or system compromise.
How To Fix
Minimum fixed version
2.12.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation and sanitization to mitigate the risk of exploitation. Additionally, avoid using untrusted data sources for serialization until the library is updated.
Conclusion
CVE-2020-36183 represents a significant security risk for applications using the jackson-databind library. It is crucial for developers to upgrade to the fixed version to protect against potential exploitation. Utilizing tools like Vulert can aid in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for jackson-databind →
FAQ
CVE-2020-36183 is a vulnerability in the jackson-databind library that allows for potential remote code execution through improper handling of serialization.
All versions of jackson-databind 2.x prior to 2.9.10.8 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities without any installation.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and the execution of arbitrary code, posing significant risks to application security.
Yes, implementing input validation and avoiding untrusted data sources for serialization can help mitigate the risk until an upgrade is possible.
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
