Critical Serialization Vulnerability in jackson-databind: CVE-2020-36189
Summary
CVE-2020-36189: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource. Affects jackson-databind across 2 version ranges.
< 2.12.1-1
>= e8df0987e3034d102ee6d704d30a05a2e3ac7089, < e19c557b789113f900018208d87446c34ae4fab3
Fixed in 2.12.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
jackson-databind is a widely used Java library that facilitates the serialization and deserialization of Java objects to and from JSON. It is a core component of the Jackson data processing framework, which is known for its performance and ease of use. The library is integral for applications that require data interchange in JSON format, making it a critical dependency in many Java projects. However, prior to version 2.9.10.8, jackson-databind was susceptible to a vulnerability that could allow attackers to exploit serialization gadgets, potentially leading to unauthorized access or data manipulation.
Vulnerability Detail
CVE-2020-36189 arises from a mishandling of the interaction between serialization gadgets and typing within jackson-databind. This vulnerability allows attackers to craft malicious input that, when deserialized, can lead to arbitrary code execution or other unintended behaviors. The issue is particularly concerning because it affects a fundamental aspect of the library's functionality, making it a high-risk vulnerability for applications relying on this library for JSON processing. The CVSS score for this vulnerability is 8.1, indicating a high severity level that necessitates immediate attention.
How To Fix
Minimum fixed version
2.12.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to sanitize and restrict the types of objects that can be deserialized. This can help mitigate the risk of exploitation until a proper update can be applied.
Conclusion
CVE-2020-36189 represents a significant security risk for applications using the jackson-databind library prior to version 2.12.1-1. It is crucial for developers to update their dependencies to mitigate this vulnerability and protect their applications from potential exploitation. Utilizing tools like Vulert can assist in monitoring and identifying such vulnerabilities in real-time.
See every vulnerability recorded for jackson-databind →
FAQ
CVE-2020-36189 is a critical vulnerability in the jackson-databind library that allows for potential arbitrary code execution through maliciously crafted JSON input.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without any installation.
Exploitation of this vulnerability can lead to unauthorized access, data manipulation, or even complete system compromise, depending on the application's architecture.
Yes, implementing strict input validation can help mitigate the risk by ensuring that only expected and safe data types are processed during deserialization.
The CVSS score for CVE-2020-36189 is 8.1, indicating a high severity level that requires prompt action.
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
