Critical Vulnerability in jackson-databind: Serialization Gadget Misconfiguration
Summary
CVE-2020-9547: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap). Affects jackson-databind across 2 version ranges.
< 2.11.1-1
>= e8df0987e3034d102ee6d704d30a05a2e3ac7089, < e8697cdbf415028b171f9b7698f3308eda00a3c7
Fixed in 2.11.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
jackson-databind is a core component of the FasterXML Jackson library, widely used for converting Java objects to JSON and vice versa. It provides powerful data-binding capabilities and is integral to many Java applications. However, prior to version 2.9.10.4, it was susceptible to a vulnerability that allowed for the exploitation of serialization gadgets, particularly concerning the com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig class.
Vulnerability Detail
The vulnerability, identified as CVE-2020-9547, arises from the mishandling of serialization gadgets and typing within jackson-databind. This flaw can be exploited by attackers to execute arbitrary code on the server, leading to potential data breaches or system compromise. The issue is particularly critical due to its high CVSS score of 9.8, indicating severe risk to affected systems. The vulnerability affects multiple versions of jackson-databind across various Debian ecosystems, making it a widespread concern.
How To Fix
Minimum fixed version
2.11.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation and sanitization to mitigate the risk of exploitation. Additionally, avoid using untrusted data sources for serialization until the upgrade is completed.
Conclusion
CVE-2020-9547 represents a significant security risk for applications utilizing jackson-databind versions prior to 2.11.1-1. It is crucial for developers and system administrators to upgrade their libraries promptly and consider implementing additional security measures to protect against potential exploitation.
See every vulnerability recorded for jackson-databind →
FAQ
CVE-2020-9547 is a critical vulnerability in the jackson-databind library that allows attackers to exploit serialization gadgets, potentially leading to arbitrary code execution.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Failure to address this vulnerability could result in unauthorized access to sensitive data, system compromise, and potential damage to your application's integrity.
Yes, implementing input validation and avoiding untrusted data sources for serialization can help mitigate the risk until an upgrade is performed.
The CVSS score for CVE-2020-9547 is 9.8, indicating a critical level of risk.
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
