Critical Vulnerability in libjackson-json-java: XML External Entity Attack Risk
Summary
UBUNTU-CVE-2019-10172: A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. Affects libjackson-json-java versions < 1.9.2-3+deb8u1build0.14.04.1~esm1. Fixed in 1.9.2-3+deb8u1build0.14.04.1~esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libjackson-json-java is a Java library used for processing JSON data. It is part of the Jackson project, which provides tools for converting Java objects to JSON and vice versa. This library is widely utilized in various applications for its efficiency and ease of use. However, it has been identified to have vulnerabilities that could expose applications to XML external entity (XXE) attacks, compromising data integrity and confidentiality.
Vulnerability Detail
A flaw was found in the org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries, which are part of the libjackson-json-java package. This vulnerability allows for XML external entity attacks, similar to CVE-2016-3720, affecting different classes within the library. If exploited, this vulnerability could allow an attacker to read sensitive files on the server or perform other malicious actions, leading to potential data breaches and system compromises.
How To Fix
Minimum fixed version
1.9.2-3+deb8u1build0.14.04.1~esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libjackson-json-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, consider disabling XML processing in the application or using a different JSON processing library that does not have this vulnerability.
Conclusion
The libjackson-json-java package has a critical vulnerability that could expose applications to XML external entity attacks. It is essential to update to the latest patched versions to safeguard against potential exploits. Users are encouraged to utilize tools like Vulert for real-time monitoring of vulnerabilities in their applications.
See every vulnerability recorded for libjackson-json-java →
FAQ
The CVSS score of this vulnerability is 5.9, indicating a medium severity level.
Versions prior to 1.9.2-3+deb8u1build0.14.04.1~esm1 for Ubuntu 14.04, 1.9.2-7ubuntu0.2 for Ubuntu 16.04, and earlier versions for Ubuntu 18.04 and 20.04 are affected.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized access to sensitive data, data breaches, and potential system compromise.
Yes, you can mitigate the risk by disabling XML processing in your application or switching to a different JSON processing library.
Related vulnerabilities
Recent vulnerabilities recorded for libjackson-json-java.
