CVE-2020-36185: High severity fasterxml jackson-databind vulnerability
A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.8 - Upgrade
Upgrade
redhat/jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.8 - Upgrade
Upgrade
jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.8 - Configuration
Do not use enableDefaultTyping(); avoid typing-based polymorphic deserialization when using @JsonTypeInfo with id.CLASS or id.MINIMAL_CLASS (configuration guidance from the provided material).
Jackson Databind (@JsonTypeInfo) defaultTyping = disable enableDefaultTyping() - Configuration
Avoid using @JsonTypeInfo with id.CLASS or id.MINIMAL_CLASS.
Jackson Databind (@JsonTypeInfo) @JsonTypeInfo(use=id) = avoid id.CLASS and id.MINIMAL_CLASS - Compensating control
Avoid/omit the listed gadget class names from the classpath: oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS, org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS, org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS, org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS, org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool, org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource, org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource, org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource, org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource, com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource, com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-36185?
CVE-2020-36185 has a high severity level that threatens data confidentiality, integrity, and system availability.
How do I fix CVE-2020-36185?
The recommended fix for CVE-2020-36185 is to upgrade FasterXML jackson-databind to version 2.9.10.8 or later.
Which versions of jackson-databind are affected by CVE-2020-36185?
CVE-2020-36185 affects jackson-databind versions 2.x before 2.9.10.8.
What types of software are impacted by CVE-2020-36185?
CVE-2020-36185 impacts various software, including applications using jackson-databind for JSON data binding.
Is CVE-2020-36185 a remote code execution vulnerability?
CVE-2020-36185 is not a direct remote code execution vulnerability but can lead to data integrity issues.