CVE-2020-24750: High severity fasterxml jackson-databind vulnerability
A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.6. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality and system availability.
Other sources
FasterXML jackson-databind 2.x before 2.6.7.5 and from 2.7.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.6 - Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.6.7.5 - Upgrade
Upgrade
redhat/rh-maven35-jackson-databindto a version that resolves this vulnerability.Fixed in 0:2.7.6-2.11.el7 - Upgrade
Upgrade
redhat/jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.6 - Upgrade
Upgrade
jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.6 - Configuration
Avoid using Jackson Databind's enableDefaultTyping() to prevent unsafe type handling during deserialization.
Jackson Databind enableDefaultTyping() = disable - Configuration
Do not configure @JsonTypeInfo with using="id.CLASS" or using="id.MINIMAL_CLASS".
Jackson Databind @JsonTypeInfo using = do not use id.CLASS or id.MINIMAL_CLASS - Compensating control
Avoid having com.pastdev.httpcomponents on the application classpath (e.g., remove/ensure the com.pastdev.httpcomponents library is not present) to prevent the referenced JndiConfiguration gadget from being available to Jackson.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-24750?
CVE-2020-24750 is a vulnerability in jackson-databind versions prior to 2.9.10.6 which mishandles the interaction between serialization gadgets and typing.
What is the severity of CVE-2020-24750?
CVE-2020-24750 has a severity rating of 8.1, which is categorized as high.
How does CVE-2020-24750 impact data confidentiality?
CVE-2020-24750 poses a threat to data confidentiality.
How does CVE-2020-24750 impact system availability?
CVE-2020-24750 poses a threat to system availability.
How can I fix CVE-2020-24750?
To fix CVE-2020-24750, update to jackson-databind version 2.9.10.6 or higher.