Security Exception in com.spotify.docker.client.shaded.com.fasterxml.jackson.databind.util.TokenBuffer
Summary
OSV-2024-120: Security exception in com.spotify.docker.client.shaded.com.fasterxml.jackson.databind.util.TokenBuffer. Affects docker-client versions >= 9a7c3b4994be9a55988f821f7177029201ff6aef. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The docker-client package is an open-source library used for interacting with the Docker API. It provides a convenient way to manage Docker containers, images, and other resources. This vulnerability affects the TokenBuffer class in the com.fasterxml.jackson.databind.util package, which is used for buffering JSON tokens during parsing and serialization.
Vulnerability Detail
The vulnerability arises from a security exception in the TokenBuffer class. When encoding a string, the code encounters an exception in the StringCoding.encode method, specifically in the String.getBytes call. This can lead to a crash or unexpected behavior in applications that utilize the docker-client library. The issue has been reported to the OSS-Fuzz project and more details can be found in the provided link.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, developers can manually handle the encoding of strings to avoid triggering the security exception. This can be done by using alternative encoding methods or libraries that do not exhibit the same issue. However, it is strongly recommended to apply the official fix by updating the docker-client package to a patched version.
Conclusion
In conclusion, the docker-client package is affected by a security exception vulnerability in the TokenBuffer class. To mitigate this issue, it is recommended to update the package to a version that includes the fix introduced in commit 9a7c3b4994be9a55988f821f7177029201ff6aef. Developers can also manually handle string encoding as a temporary workaround. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for docker-client →
FAQ
The vulnerability can lead to crashes or unexpected behavior in applications that use the docker-client library. It may also potentially be exploited by malicious actors to execute arbitrary code or perform other unauthorized actions.
At the time of this report, there are no known public exploits for this vulnerability. However, it is always recommended to apply security patches promptly to mitigate any potential risks.
No, only versions prior to the commit 9a7c3b4994be9a55988f821f7177029201ff6aef are affected. Updating to a version that includes this commit will resolve the vulnerability.
The vulnerability itself does not provide remote code execution capabilities. However, if an application utilizing the docker-client library is exposed to untrusted input, it may be possible for an attacker to trigger the vulnerability remotely.
For more details about this vulnerability, including technical information and the fix, refer to the provided OSS-Fuzz report and the source code repository on GitHub.
References
Related vulnerabilities
Recent vulnerabilities recorded for docker-client.
