Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2020-35728

Опубликовано: 23 дек. 2020
Источник: redhat
CVSS3: 8.1

Описание

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Отчет

The following Red Hat Products ship jackson-databind version 2.10.0 or later which is not considered affected by this CVE (see https://medium.com/@cowtowncoder/jackson-2-10-safe-default-typing-2d018f0ce2ba)

  • JBoss Data Grid 7
  • JBoss Data Grid 8
  • Enterprise Application Platform 7
  • Red Hat Decision Manager 7
  • Red Hat Process Automation Manager 7
  • Red Hat Single Sign-On (RH-SSO) 7
  • Red Hat JBoss Fuse 7
  • Red Hat JBoss A-MQ
  • Red Hat Enterprise Linux 8
  • Red Hat Satellite 6.6
  • Red Hat Satellite 6.7
  • Red Hat Satellite 6.8
  • Red Hat CodeReady Studio 12 Red Hat OpenShift Container Platform and Red Hat OpenStack Platform does ship the vulnerable components, but does not enable the unsafe conditions needed to exploit, lowering their vulnerability impact. In Red Hat Openshift 4 there are no plans to maintain the ose-logging-elasticsearch5 container, hence it has been marked wontfix at this time and may be fixed in a future update. Red Hat OpenStack Platform 13 ships OpenDaylight, which contains the vulnerable jackson-databind, but does not expose jackson-databind in a way that would make it exploitable. As such, Red Hat will not be providing a fix for OpenDaylight at this time.

Меры по смягчению последствий

The following conditions are needed for an exploit, we recommend avoiding all if possible:

  • Deserialization from sources you do not control
  • enableDefaultTyping()
  • @JsonTypeInfo using id.CLASSorid.MINIMAL_CLASS`
  • avoid com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool in the classpath

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
A-MQ Clients 2jackson-databindNot affected
Red Hat BPM Suite 6jackson-databindOut of support scope
Red Hat build of Quarkusjackson-databindNot affected
Red Hat CodeReady Studio 12jackson-databindNot affected
Red Hat Data Grid 8jackson-databindNot affected
Red Hat Decision Manager 7jackson-databindNot affected
Red Hat Enterprise Linux 8pki-deps:10.6/jackson-databindNot affected
Red Hat Enterprise Linux 9jackson-databindNot affected
Red Hat Fuse 7jackson-databindNot affected
Red Hat Integration Camel K 1jackson-databindNot affected

Показывать по

Дополнительная информация

Статус:

Important
Дефект:
CWE-96
https://bugzilla.redhat.com/show_bug.cgi?id=1911502jackson-databind: mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool

8.1 High

CVSS3

Связанные уязвимости

CVSS3: 8.1
ubuntu
около 5 лет назад

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

CVSS3: 8.1
nvd
около 5 лет назад

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

CVSS3: 8.1
debian
около 5 лет назад

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interact ...

CVSS3: 8.1
github
около 4 лет назад

Serialization gadget exploit in jackson-databind

CVSS3: 8.1
fstec
около 5 лет назад

Уязвимость библиотеки Jackson-databind проекта FasterXML, связанная с восстановлением в памяти недостоверных данных, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

8.1 High

CVSS3