XML External Entity Vulnerability in Jackson Mapper ASL (CVE-2019-10172)
Summary
CVE-2019-10172: A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. Affects libjackson-json-java across 2 version ranges.
< 1.9.13-2
< 2b147c4cd50da32fe2b4167f97c8142102a0510d
Fixed in 1.9.13-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jackson Mapper ASL library, specifically version 1.9.x, is a widely used JSON processing library in Java applications. It provides functionalities for converting Java objects to JSON and vice versa. However, this library has been found to be vulnerable to XML External Entity (XXE) attacks, which can lead to unauthorized access to sensitive data and potential system compromise.
Vulnerability Detail
A flaw was identified in the org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries, where XML external entity vulnerabilities similar to CVE-2016-3720 affect the codehaus jackson-mapper-asl libraries. This vulnerability allows attackers to exploit the XML parsing capabilities of the library, potentially leading to data exposure or denial of service. The vulnerability is particularly concerning as it can be triggered without user interaction, making it a significant risk for applications relying on this library.
How To Fix
Minimum fixed version
1.9.13-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libjackson-json-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider disabling XML processing features in your application or using a different JSON processing library that does not have this vulnerability. Additionally, ensure that any XML input is properly sanitized before processing.
Conclusion
CVE-2019-10172 represents a significant security risk for applications using the Jackson Mapper ASL library. It is crucial to address this vulnerability by upgrading to the fixed version or implementing workarounds to mitigate potential risks. Regular monitoring and vulnerability management practices are essential to maintain application security.
See every vulnerability recorded for libjackson-json-java →
FAQ
CVE-2019-10172 is a vulnerability in the Jackson Mapper ASL library that allows for XML External Entity attacks, potentially leading to unauthorized data access.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software by simply uploading your manifest file, such as package-lock.json.
The CVSS score for CVE-2019-10172 is 7.5, indicating a high severity level.
If an upgrade is not possible, consider disabling XML processing features or sanitizing XML input before processing.
More information can be found in the official CVE database or by visiting the Vulert website for real-time monitoring of vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for libjackson-json-java.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
