CVE-2020-36179: High severity NetApp Cloud Backup vulnerability
A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.6.7.5 - Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.8 - Upgrade
Upgrade
redhat/jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.8 - Upgrade
Upgrade
com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.8 - Upgrade
Upgrade
com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.6.7.5 - Configuration
Do not use @JsonTypeInfo with `using` set to `id.CLASS` or `id.MINIMAL_CLASS`.
Jackson Databind (@JsonTypeInfo) @JsonTypeInfo using = id.CLASS or id.MINIMAL_CLASS - Configuration
Do not call `enableDefaultTyping()`; avoid default typing.
Jackson Databind (ObjectMapper) enableDefaultTyping() = disabled - Compensating control
Avoid placing these named classes on the classpath to reduce deserialization gadget availability: oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS, org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS, org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS, org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS, org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool, org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource, org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource, com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource, com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What are the impacted versions for CVE-2020-36179?
CVE-2020-36179 affects FasterXML jackson-databind versions prior to 2.9.10.8 and 2.6.7.5.
What is the severity of CVE-2020-36179?
CVE-2020-36179 poses a high severity threat to data confidentiality, integrity, and system availability.
How do I fix CVE-2020-36179?
To fix CVE-2020-36179, you should update FasterXML jackson-databind to version 2.9.10.8 or 2.6.7.5 or later.
What are the consequences of exploiting CVE-2020-36179?
Exploiting CVE-2020-36179 can lead to data breaches, manipulation of data integrity, and potential system outages.
Is CVE-2020-36179 related to serialization gadgets?
Yes, CVE-2020-36179 involves the mishandling of serialization gadgets which can compromise security.