CVE-2018-12022: High severity fasterxml jackson-databind vulnerability
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
Other sources
FasterXML jackson-databind before versions 2.7.9.4, 2.8.11.2, 2.9.6 fails to block polymorphic deserialization of types from Jodd-db library. This could lead to Remote Code Execution.
Reference: https://github.com/FasterXML/jackson-databind/issues/2052
Upstream Patch: https://github.com/FasterXML/jackson-databind/commit/7487cf7eb14be2f65a1eb108e8629c07ef45e0a1
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.8-3+deb10u3Fixed in 2.9.8-3+deb10u5Fixed in 2.12.1-1+deb11u1Fixed in 2.14.0-1 - Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.8.11.2 - Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.7.9.4 - Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.6 - Upgrade
Upgrade
redhat/jackson-databindto a version that resolves this vulnerability.Fixed in 2.7.9.4 - Upgrade
Upgrade
redhat/jackson-databindto a version that resolves this vulnerability.Fixed in 2.8.11.2 - Upgrade
Upgrade
redhat/jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.6 - Upgrade
Upgrade
FasterXML jackson-databindto a version that resolves this vulnerability.Fixed in 2.7.9.4 - Upgrade
Upgrade
FasterXML jackson-databindto a version that resolves this vulnerability.Fixed in 2.8.11.2 - Upgrade
Upgrade
FasterXML jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.6 - Configuration
Ensure Default Typing is not enabled (neither globally nor for specific properties), since the issue applies when Default Typing is enabled and the Jodd-db jar is present on the classpath.
FasterXML jackson-databind Default typing = disable (not enabled globally or for specific properties) - Compensating control
Remove the jodd-db jar from the application classpath if it is not required (the upstream patch notes the vulnerability involves presence of the Jodd-db jar on the classpath when Default Typing is enabled).
Event History
Frequently Asked Questions
What is CVE-2018-12022?
CVE-2018-12022 is a vulnerability in FasterXML jackson-databind that could allow a remote attacker to execute arbitrary code on the system.
What is the severity of CVE-2018-12022?
The severity of CVE-2018-12022 is critical, with a CVSS score of 9.8.
How does CVE-2018-12022 work?
CVE-2018-12022 occurs when Default Typing is enabled, the Jodd-db jar is in the classpath, and an attacker can provide an LDAP reference as a property value.
Which versions of jackson-databind are affected by CVE-2018-12022?
CVE-2018-12022 affects jackson-databind versions up to 2.7.9.4, 2.8.11.2, and 2.9.6.
How do I fix CVE-2018-12022?
To fix CVE-2018-12022, update jackson-databind to version 2.7.9.4, 2.8.11.2, or 2.9.6.