CVE-2020-11111: High severity fasterxml jackson-databind vulnerability
A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
A vulnerability was found in Jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq. (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).
— Red Hat
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq. (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-maven35-jackson-databindto a version that resolves this vulnerability.Fixed in 0:2.7.6-2.9.el7 - Upgrade
Upgrade
redhat/Jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.4 - Upgrade
Upgrade
com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.4 - Configuration
Do not enable Jackson polymorphic type handling with @JsonTypeInfo using id.CLASS or id.MINIMAL_CLASS.
FasterXML/Jackson Databind @JsonTypeInfo using (id.CLASS / id.MINIMAL_CLASS) = Avoid (do not use id.CLASS or id.MINIMAL_CLASS) - Configuration
Do not call enableDefaultTyping(); the advisory recommends avoiding this configuration for exploitation conditions.
FasterXML/Jackson Databind enableDefaultTyping() = Disable/avoid calling enableDefaultTyping() - Compensating control
Avoid using org.apache.activemq.* serialization gadgets in combination with Jackson typing (activemq-jms, activemq-core, activemq-pool, activemq-pool-jms), since the vulnerability relates to the mishandled interaction between serialization gadgets and typing.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-11111?
CVE-2020-11111 is a vulnerability in FasterXML jackson-databind 2.x before 2.9.10.4 that allows a remote attacker to execute arbitrary code on the system by exploiting unsafe deserialization in org.apache.activemq.*.
How severe is CVE-2020-11111?
CVE-2020-11111 has a severity rating of 9.8 (Critical) according to the CVSS v3.1 rating system.
Which software versions are affected by CVE-2020-11111?
The vulnerability affects FasterXML jackson-databind versions 2.x, specifically versions prior to 2.9.10.4.
How can I fix CVE-2020-11111?
To fix CVE-2020-11111, update FasterXML jackson-databind to version 2.9.10.4 or later.
Where can I find more information about CVE-2020-11111?
More information about CVE-2020-11111 can be found in the references provided: [GitHub](https://github.com/FasterXML/jackson-databind/issues/2664), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1821307), [GitHub Commit](https://github.com/FasterXML/jackson-databind/commit/05d7e0e13f43e12db6a51726df12c8b4d8040676)