CVE-2020-36188: High severity fasterxml jackson-databind vulnerability
A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.6.7.5 - Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.8 - Upgrade
Upgrade
redhat/jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 - Configuration
Avoid using @JsonTypeInfo with `using` set to `id.CLASS` or `id.MINIMAL_CLASS` when deserializing data from sources you do not control.
Jackson Databind @JsonTypeInfo using = id.CLASS or id.MINIMAL_CLASS - Configuration
Do not use `enableDefaultTyping()` when deserializing data from sources you do not control.
Jackson Databind enableDefaultTyping() = disabled - Configuration
If default typing is enabled or any polymorphic typing is configured, avoid mappings that include any of these classes (as they relate to serialization gadget interaction): oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS, org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS, org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS, org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS, org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool, org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource, org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource, org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource, org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource, com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource, com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.
Jackson Databind Default typing / allowed type mappings = exclude listed gadget classes - Compensating control
Ensure the potentially dangerous classes related to the reported gadget chain are not present in the application classpath; the material states the interaction is related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and that exploitation requires classes to be in the classpath.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-36188?
The severity of CVE-2020-36188 is high, primarily affecting data confidentiality and integrity.
How do I fix CVE-2020-36188?
To fix CVE-2020-36188, upgrade to jackson-databind version 2.6.7.5 or 2.9.10.8 or later.
Which versions are affected by CVE-2020-36188?
CVE-2020-36188 affects FasterXML jackson-databind versions prior to 2.6.7.5 and 2.9.10.8.
What type of vulnerability is CVE-2020-36188?
CVE-2020-36188 is categorized as a deserialization vulnerability.
What can be impacted by CVE-2020-36188?
CVE-2020-36188 can potentially impact data confidentiality, integrity, and system availability.