Critical XML External Entity Vulnerability in libjackson-json-java Package
Summary
DEBIAN-CVE-2019-10172: A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. Affects libjackson-json-java versions < 1.9.13-2. Fixed in 1.9.13-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libjackson-json-java is a Java library that provides functionality for processing JSON data using the Jackson framework. It is widely used in various applications for its efficiency and ease of use in handling JSON serialization and deserialization. However, this package has been found to be vulnerable to XML external entity (XXE) attacks, which can lead to unauthorized access to sensitive data or system resources.
Vulnerability Detail
A flaw was discovered in the org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries, which are part of the libjackson-json-java package. This vulnerability is similar to CVE-2016-3720, affecting different classes within the codehaus jackson-mapper-asl libraries. Attackers can exploit this vulnerability to perform XML external entity attacks, potentially leading to data exposure or system compromise.
How To Fix
Minimum fixed version
1.9.13-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libjackson-json-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, consider disabling XML processing features in your application or using alternative libraries that do not have this vulnerability. Review your application's configuration to ensure that it does not process untrusted XML input.
Conclusion
The libjackson-json-java package has a critical vulnerability related to XML external entity processing. Users are strongly advised to update to the latest patched version to mitigate risks associated with this vulnerability. Regular monitoring and updates are essential for maintaining application security.
See every vulnerability recorded for libjackson-json-java →
FAQ
The vulnerability is an XML external entity (XXE) issue that can allow attackers to access sensitive data or perform unauthorized actions.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Exploitation of this vulnerability can lead to data breaches, unauthorized access to system resources, and potential compromise of the application.
Yes, a patched version of the libjackson-json-java package is available. Users should update to version 1.9.13-2 or later.
If immediate updating is not feasible, consider disabling XML processing features or using alternative libraries that do not have this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for libjackson-json-java.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
