Critical JNDI Injection Vulnerability in jackson-databind Package
Summary
CVE-2020-8840: FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter. Affects jackson-databind across 2 version ranges.
< 2.11.1-1
>= e8df0987e3034d102ee6d704d30a05a2e3ac7089, < e8697cdbf415028b171f9b7698f3308eda00a3c7
Fixed in 2.11.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jackson-databind is a widely-used Java library that facilitates the conversion between Java objects and JSON. It is a core component of the Jackson suite, which is known for its performance and ease of use in data binding. The library is integral to many Java applications, allowing developers to easily serialize and deserialize data. However, certain versions of jackson-databind are vulnerable to a JNDI injection attack, which can lead to severe security breaches.
Vulnerability Detail
The vulnerability, identified as CVE-2020-8840, affects versions of jackson-databind from 2.0.0 to 2.9.10.2. It lacks adequate blocking mechanisms for xbean-reflect and JNDI, allowing attackers to exploit the library by injecting malicious JNDI lookups. This could lead to remote code execution or data leakage, posing significant risks to applications that rely on this library. The vulnerability has a CVSS score of 9.8, indicating its critical nature.
How To Fix
Minimum fixed version
2.11.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, consider implementing input validation and sanitization to mitigate the risk of JNDI injection. Additionally, review your application's use of JNDI and restrict its functionality where possible.
Conclusion
CVE-2020-8840 represents a significant security risk for applications using vulnerable versions of jackson-databind. It is crucial for developers to upgrade to the latest version to protect against potential exploitation. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in your software.
See every vulnerability recorded for jackson-databind →
FAQ
CVE-2020-8840 is a critical vulnerability in the jackson-databind library that allows for JNDI injection attacks, potentially leading to remote code execution.
Versions from 2.0.0 to 2.9.10.2 are vulnerable to this issue.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply uploading your manifest file, you can check for vulnerabilities without any installation.
Implement input validation and restrict JNDI functionality as a temporary workaround until you can upgrade to a secure version.
The CVSS score for CVE-2020-8840 is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
