CVE-2020-11112: High severity fasterxml jackson-databind vulnerability
A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
A vulnerability was found in Jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).
— Red Hat
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-maven35-jackson-databindto a version that resolves this vulnerability.Fixed in 0:2.7.6-2.9.el7 - Upgrade
Upgrade
redhat/Jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.4 - Upgrade
Upgrade
com.fasterxml.jackson.core:jackson-databind 2.xto a version that resolves this vulnerability.Fixed in 2.9.10.4 - Configuration
Do not configure polymorphic typing with @JsonTypeInfo using id.CLASS or id.MINIMAL_CLASS.
Jackson Databind @JsonTypeInfo use of id.CLASS or id.MINIMAL_CLASS = Avoid using id.CLASS and id.MINIMAL_CLASS - Configuration
Do not enable default typing via enableDefaultTyping().
Jackson Databind enableDefaultTyping() = Disable (do not call enableDefaultTyping()) - Compensating control
Avoid deserialization from sources you do not control.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-11112?
CVE-2020-11112 is a vulnerability found in FasterXML jackson-databind 2.x before 2.9.10.4 that mishandles the interaction between serialization gadgets and typing.
What is the severity of CVE-2020-11112?
The severity of CVE-2020-11112 is high, with a CVSS score of 8.1.
How does CVE-2020-11112 affect the system?
CVE-2020-11112 can lead to data confidentiality and integrity compromises, as well as system availability issues.
Which software versions are affected by CVE-2020-11112?
FasterXML jackson-databind 2.x up to but excluding 2.9.10.4 is affected by CVE-2020-11112.
How can CVE-2020-11112 be fixed?
To fix CVE-2020-11112, update FasterXML jackson-databind to version 2.9.10.4 or later.