CVE-2020-36184: High severity NetApp Cloud Backup vulnerability
A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.8 - Upgrade
Upgrade
redhat/jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.8 - Upgrade
Upgrade
jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.8 - Configuration
Avoid using @JsonTypeInfo with id.CLASS or id.MINIMAL_CLASS for polymorphic type handling, as described in the material.
Jackson Databind @JsonTypeInfo use (id.CLASS / id.MINIMAL_CLASS) = avoid - Configuration
Do not call enableDefaultTyping(); the material lists it as a condition to avoid.
Jackson Databind enableDefaultTyping() = disable - Compensating control
Avoid the listed classes in the classpath to reduce gadget availability for the exploit (e.g., org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource, org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource, and the other explicitly named examples in the material).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-36184?
CVE-2020-36184 has a high severity level, affecting data confidentiality, integrity, and system availability.
How do I fix CVE-2020-36184?
To mitigate CVE-2020-36184, upgrade FasterXML jackson-databind to version 2.9.10.8 or later.
Which versions of jackson-databind are affected by CVE-2020-36184?
CVE-2020-36184 affects versions of jackson-databind prior to 2.9.10.8.
What vulnerabilities are associated with jackson-databind and CVE-2020-36184?
CVE-2020-36184 presents risks mainly related to deserialization vulnerabilities that may lead to remote code execution or other exploits.
Are there any workarounds for CVE-2020-36184 while waiting for a fix?
Currently, the recommended action for CVE-2020-36184 is to upgrade the software, as no specific workarounds are provided.