Veracode Vulnerability DatabaseVERACODE:5854Remote Code Execution (RCE)
0.939 High
EPSS
Percentile
99.2%
jackson-databind is vulnerable to remote code execution (RCE) attacks. Due to an incomplete fix for CVE-2017-7525, attackers can still send malicious code through JSON. The blacklist that was implemented, didn’t take into account the c3p0 gadgets available in the classpath.In order to be vulnerable to this attack, either the use of @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS) or @JsonTypeInfo(use = JsonTypeInfo.Id.MINIMAL_CLASS) or a call to ObjectMapper.enableDefaultTyping(...) is needed.
References
www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
www.securityfocus.com/bid/103203
www.securitytracker.com/id/1040693
www.securitytracker.com/id/1041890
access.redhat.com/errata/RHSA-2018:1447
access.redhat.com/errata/RHSA-2018:1448
access.redhat.com/errata/RHSA-2018:1449
access.redhat.com/errata/RHSA-2018:1450
access.redhat.com/errata/RHSA-2018:1451
access.redhat.com/errata/RHSA-2018:1786
access.redhat.com/errata/RHSA-2018:2088
access.redhat.com/errata/RHSA-2018:2089
access.redhat.com/errata/RHSA-2018:2090
access.redhat.com/errata/RHSA-2018:2938
access.redhat.com/errata/RHSA-2018:2939
access.redhat.com/errata/RHSA-2019:2858
access.redhat.com/errata/RHSA-2019:3149
github.com/FasterXML/jackson-databind/issues/1931
lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1@%3Ccommits.druid.apache.org%3E
medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
security.netapp.com/advisory/ntap-20180328-0001/
support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us
www.debian.org/security/2018/dsa-4190
www.oracle.com/security-alerts/cpuoct2020.html
www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
www.sourceclear.com/vulnerability-database/security/remote-code-execution-rce-through-deserialization/java/sid-3929/summary
Related
