CVE-2020-36182: High severity fasterxml jackson-databind vulnerability
A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.6.7.5 - Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.8 - Upgrade
Upgrade
redhat/jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.8 - Upgrade
Upgrade
jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.8 - Upgrade
Upgrade
jackson-databindto a version that resolves this vulnerability.Fixed in 2.6.7.5 - Configuration
Avoid using @JsonTypeInfo with using=id.CLASS or using=id.MINIMAL_CLASS, as the issue is triggered by the interaction between serialization gadgets and typing.
Jackson Databind (com.fasterxml.jackson.databind) @JsonTypeInfo using = id.CLASS / id.MINIMAL_CLASS - Configuration
Do not call enableDefaultTyping(); avoid it because it participates in the gadget/typing interaction described for jackson-databind 2.x.
Jackson Databind (com.fasterxml.jackson.databind) enableDefaultTyping() = disabled - Compensating control
Ensure the listed classes/adapters are not present in the application classpath: oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS, org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS, org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS, org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS, org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool, org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource, org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource, org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource, org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource, com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource, com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-36182?
CVE-2020-36182 has a high severity and poses risks to data confidentiality, integrity, and system availability.
How do I fix CVE-2020-36182?
To mitigate CVE-2020-36182, update jackson-databind to version 2.6.7.5 or 2.9.10.8 or later.
Which versions of jackson-databind are affected by CVE-2020-36182?
CVE-2020-36182 affects jackson-databind versions before 2.6.7.5 and 2.9.10.8.
What types of applications are impacted by CVE-2020-36182?
Applications utilizing jackson-databind for JSON serialization and deserialization are impacted by CVE-2020-36182.
Are there known exploits for CVE-2020-36182?
While there are no public exploits reported for CVE-2020-36182, its potential to compromise data security makes it critical to apply the necessary updates.