Critical Vulnerability in jackson-databind: Serialization Gadget Misconfiguration
Summary
CVE-2020-9548: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core). Affects jackson-databind across 2 version ranges.
< 2.11.1-1
>= e8df0987e3034d102ee6d704d30a05a2e3ac7089, < e8697cdbf415028b171f9b7698f3308eda00a3c7
Fixed in 2.11.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jackson-databind is a core component of the FasterXML Jackson library, widely used for converting Java objects to JSON and vice versa. It provides data-binding capabilities, allowing developers to easily serialize and deserialize Java objects. However, certain versions of jackson-databind are susceptible to vulnerabilities that can be exploited through serialization gadgets, leading to potential security risks.
Vulnerability Detail
The vulnerability identified as CVE-2020-9548 affects FasterXML jackson-databind versions prior to 2.9.10.4. It arises from a mishandling of the interaction between serialization gadgets and typing, specifically related to the br.com.anteros.dbcp.AnterosDBCPConfig class. Attackers can exploit this vulnerability to execute arbitrary code on the server, resulting in unauthorized access and potential data breaches. The CVSS score for this vulnerability is 9.8, indicating a critical severity level.
How To Fix
Minimum fixed version
2.11.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider implementing strict input validation and sanitization to mitigate the risk of exploitation. Additionally, avoid using untrusted data sources for deserialization until the vulnerability is resolved.
Conclusion
CVE-2020-9548 is a critical vulnerability in the jackson-databind library that poses significant risks to applications using affected versions. It is essential to upgrade to the fixed version to mitigate potential security threats. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for jackson-databind →
FAQ
CVE-2020-9548 is a critical vulnerability in the jackson-databind library that allows attackers to exploit serialization gadgets, potentially leading to arbitrary code execution.
Versions of jackson-databind prior to 2.9.10.4 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an upgrade is not possible, implement strict input validation and avoid deserializing untrusted data until you can apply the fix.
The CVSS score for CVE-2020-9548 is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
