Critical Vulnerability in jackson-databind: Serialization Gadget Interaction Flaw
Summary
CVE-2021-20190: A flaw was found in jackson-databind before 2.9.10.7. Affects jackson-databind across 2 version ranges.
< 2.12.1-1
< e19c557b789113f900018208d87446c34ae4fab3
Fixed in 2.12.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jackson-databind is a core component of the Jackson library, widely used for converting Java objects to JSON and vice versa. It provides powerful data-binding capabilities, allowing developers to easily serialize and deserialize Java objects. However, prior to version 2.9.10.7, jackson-databind was susceptible to a vulnerability that could compromise data confidentiality, integrity, and system availability.
Vulnerability Detail
A flaw was found in jackson-databind before version 2.9.10.7, where FasterXML mishandles the interaction between serialization gadgets and typing. This vulnerability can lead to unauthorized data access, manipulation, or system crashes, posing a significant threat to the integrity and availability of affected systems. The CVSS score for this vulnerability is 8.1, indicating a high severity level.
How To Fix
Minimum fixed version
2.12.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing strict input validation and sanitization to mitigate the risk of exploitation. Additionally, monitor your application for unusual behavior that may indicate an attempted attack.
Conclusion
The vulnerability CVE-2021-20190 in jackson-databind poses significant risks to data confidentiality and system integrity. It is crucial for developers to upgrade to the latest version to safeguard their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities effectively.
See every vulnerability recorded for jackson-databind →
FAQ
The impact includes potential unauthorized access to sensitive data, data manipulation, and system crashes.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Versions of jackson-databind prior to 2.9.10.7 are affected by this vulnerability.
Yes, implementing strict input validation and monitoring for unusual behavior can help mitigate risks.
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
