CVE-2020-36183: High severity fasterxml jackson-databind vulnerability
A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.6.7.5 - Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.8 - Upgrade
Upgrade
redhat/jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.8 - Upgrade
Upgrade
jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.8 - Upgrade
Upgrade
jackson-databindto a version that resolves this vulnerability.Fixed in 2.6.7.5 - Configuration
Do not configure @JsonTypeInfo with `using = id.CLASS` or `using = id.MINIMAL_CLASS` for polymorphic deserialization.
Jackson databind (@JsonTypeInfo) @JsonTypeInfo using (id.CLASS / id.MINIMAL_CLASS) = Avoid id.CLASS and id.MINIMAL_CLASS - Configuration
Avoid enabling polymorphic type handling by not using `enableDefaultTyping()`.
Jackson databind ObjectMapper enableDefaultTyping() = Disable / do not call enableDefaultTyping() - Compensating control
Avoid the listed classes in the classpath: oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS, org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS, org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS, org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS, org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool, org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource, org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource, org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource, org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource, com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource, com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-36183?
CVE-2020-36183 has a high severity due to its impact on data confidentiality, integrity, and system availability.
How do I fix CVE-2020-36183?
To fix CVE-2020-36183, upgrade to Jackson Databind version 2.6.7.5 or 2.9.10.8 or later.
Which software is affected by CVE-2020-36183?
CVE-2020-36183 affects FasterXML Jackson Databind versions prior to 2.6.7.5 and 2.9.10.8.
What type of vulnerability is CVE-2020-36183?
CVE-2020-36183 is a deserialization vulnerability that involves improper handling of serialization gadgets.
Is there a known exploit for CVE-2020-36183?
While specific exploits for CVE-2020-36183 are not widely publicized, the nature of deserialization vulnerabilities suggests that systems may be at risk.