jackson-databind: mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool
Published Dec 27, 2020
8.1
HIGHCVSS 3.1
EPSS 12.50%
Description
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).
Affected products
No data.
Configuration 1
- ≥ 2.0.0 · < 2.6.7.5
- ≥ 2.7.0 · < 2.9.10.8
Configuration 2
- 9.0
Configuration 3
- n/a
Configuration 4
- 9.3.6
- 13.3.0.1
- 21.0.2
- 14.2
- 14.3
- 14.5
- 14.2
- 14.3
- 14.5
- 14.2
- 14.3
- 14.5
- 14.2
- 14.3
- 14.5
- 14.4
- 14.2.0
- 14.3.0
- 14.5.0
- ≤ 21.1.2
- ≥ 11.3.0 · ≤ 11.3.2
- 11.2.0
- 7.5.0.23.0
- 12.0.0.3.0
- 1.14.0
- 1.4.0
- 12.0.4.0.0
- ≥ 8.0.0.0 · ≤ 8.5.0.0
- ≥ 8.2.0.0 · ≤ 8.2.4.0
- 7.1
- 12.0.4.0.0
- 12.5.0
- 7.0
- ≥ 8.0.0.0 · ≤ 8.2.2.1
- ≥ 8.2.0.0 · ≤ 8.2.2.1
- 7.4.1
- 12.2.1.4.0
- 19.1.0.0.0
- ≥ 11.1.0 · ≤ 11.3.0
- 11.0.2
- ≥ 11.1.0 · ≤ 11.3.0
- 11.0.2
- < 9.2.5.3
- < 9.2.5.3
- ≥ 17.12.0 · ≤ 17.12.11
- ≥ 18.8.0 · ≤ 18.8.11
- ≥ 19.12.0 · ≤ 19.12.10
- 20.12.0
- ≥ 17.7 · ≤ 17.12
- ≥ 18.8 · ≤ 19.12
- 20.12
- ≥ 16.0 · ≤ 19.0
- 15.0.3
- 14.1.3.2
- 15.0.3.1
- 16.0.3.0
- 16.0.6
- 17.0.4
- 18.0.3
- 19.0.2
- 12.2.1.3.0
- 12.2.1.4.0
No data.
OpenShift Logging 5.0
openshift-logging/elasticsearch6-rhel8:v5.0.3-1
Fixed · RHSA-2021:1515
Red Hat OpenShift Container Platform 4.6
openshift4/ose-logging-elasticsearch6:v4.6.0-202104161407.p0
Fixed · RHSA-2021:1230
A-MQ Clients 2
jackson-databind
Not affected
Red Hat BPM Suite 6
jackson-databind
Out of support scope
Red Hat Data Grid 8
jackson-databind
Not affected
Red Hat Decision Manager 7
jackson-databind
Not affected
Red Hat Enterprise Linux 8
pki-deps:10.6/jackson-databind
Not affected
Red Hat Enterprise Linux 9
jackson-databind
Not affected
Red Hat Fuse 7
jackson-databind
Not affected
Red Hat Integration Camel K 1
jackson-databind
Not affected
Red Hat Integration Service Registry
jackson-databind
Not affected
Red Hat JBoss A-MQ 6
jackson-databind
Not affected
Red Hat JBoss BRMS 6
jackson-databind
Out of support scope
Red Hat JBoss Data Grid 7
jackson-databind
Not affected
Red Hat JBoss Data Virtualization 6
jackson-databind
Out of support scope
Red Hat JBoss Enterprise Application Platform 6
jackson-databind
Not affected
Red Hat JBoss Enterprise Application Platform 7
jackson-databind
Not affected
Red Hat JBoss Enterprise Application Platform Expansion Pack
jackson-databind
Not affected
Red Hat JBoss Fuse 6
jackson-databind
Not affected
Red Hat JBoss Fuse Service Works 6
jackson-databind
Out of support scope
Red Hat OpenShift Application Runtimes
jackson-databind
Not affected
Red Hat OpenShift Container Platform 3.11
openshift3/ose-logging-elasticsearch5
Affected
Red Hat OpenShift Container Platform 4
openshift4/ose-logging-elasticsearch5
Will not fix
Red Hat OpenShift Container Platform 4
openshift4/ose-metering-hadoop
Affected
Red Hat OpenShift Container Platform 4
openshift4/ose-metering-hive
Affected
Red Hat OpenShift Container Platform 4
openshift4/ose-metering-presto
Not affected
Red Hat OpenStack Platform 10 (Newton)
opendaylight
Out of support scope
Red Hat OpenStack Platform 13 (Queens)
opendaylight
Will not fix
Red Hat Process Automation 7
jackson-databind
Not affected
Red Hat Satellite 6
candlepin
Not affected
Red Hat Single Sign-On 7
jackson-databind
Not affected
Red Hat build of Quarkus
jackson-databind
Not affected
streams for Apache Kafka
jackson-databind
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| OpenShift Logging 5.0 | openshift-logging/elasticsearch6-rhel8:v5.0.3-1 | Fixed | RHSA-2021:1515 |
| Red Hat OpenShift Container Platform 4.6 | openshift4/ose-logging-elasticsearch6:v4.6.0-202104161407.p0 | Fixed | RHSA-2021:1230 |
| A-MQ Clients 2 | jackson-databind | Not affected | n/a |
| Red Hat BPM Suite 6 | jackson-databind | Out of support scope | n/a |
| Red Hat Data Grid 8 | jackson-databind | Not affected | n/a |
| Red Hat Decision Manager 7 | jackson-databind | Not affected | n/a |
| Red Hat Enterprise Linux 8 | pki-deps:10.6/jackson-databind | Not affected | n/a |
| Red Hat Enterprise Linux 9 | jackson-databind | Not affected | n/a |
| Red Hat Fuse 7 | jackson-databind | Not affected | n/a |
| Red Hat Integration Camel K 1 | jackson-databind | Not affected | n/a |
| Red Hat Integration Service Registry | jackson-databind | Not affected | n/a |
| Red Hat JBoss A-MQ 6 | jackson-databind | Not affected | n/a |
| Red Hat JBoss BRMS 6 | jackson-databind | Out of support scope | n/a |
| Red Hat JBoss Data Grid 7 | jackson-databind | Not affected | n/a |
| Red Hat JBoss Data Virtualization 6 | jackson-databind | Out of support scope | n/a |
| Red Hat JBoss Enterprise Application Platform 6 | jackson-databind | Not affected | n/a |
| Red Hat JBoss Enterprise Application Platform 7 | jackson-databind | Not affected | n/a |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | jackson-databind | Not affected | n/a |
| Red Hat JBoss Fuse 6 | jackson-databind | Not affected | n/a |
| Red Hat JBoss Fuse Service Works 6 | jackson-databind | Out of support scope | n/a |
| Red Hat OpenShift Application Runtimes | jackson-databind | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | openshift3/ose-logging-elasticsearch5 | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-logging-elasticsearch5 | Will not fix | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-metering-hadoop | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-metering-hive | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-metering-presto | Not affected | n/a |
| Red Hat OpenStack Platform 10 (Newton) | opendaylight | Out of support scope | n/a |
| Red Hat OpenStack Platform 13 (Queens) | opendaylight | Will not fix | n/a |
| Red Hat Process Automation 7 | jackson-databind | Not affected | n/a |
| Red Hat Satellite 6 | candlepin | Not affected | n/a |
| Red Hat Single Sign-On 7 | jackson-databind | Not affected | n/a |
| Red Hat build of Quarkus | jackson-databind | Not affected | n/a |
| streams for Apache Kafka | jackson-databind | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
The following Red Hat Products ship jackson-databind version 2.10.0 or later which is not considered affected by this CVE (see https://medium.com/@cowtowncoder/jackson-2-10-safe-default-typing-2d018f0ce2ba) * JBoss Data Grid 7 * JBoss Data Grid 8 * Enterprise Application Platform 7 * Red Hat Decision Manager 7 * Red Hat Process Automation Manager 7 * Red Hat Single Sign-On (RH-SSO) 7 * Red Hat JBoss Fuse 7 * Red Hat JBoss A-MQ * Red Hat Enterprise Linux 8 * Red Hat Satellite 6.6 * Red Hat Satellite 6.7 * Red Hat Satellite 6.8 * Red Hat CodeReady Studio 12 Red Hat OpenShift Container Platform and Red Hat OpenStack Platform does ship the vulnerable components, but does not enable the unsafe conditions needed to exploit, lowering their vulnerability impact. In Red Hat Openshift 4 there are no plans to maintain the ose-logging-elasticsearch5 container, hence it has been marked wontfix at this time and may be fixed in a future update. Red Hat OpenStack Platform 13 ships OpenDaylight, which contains the vulnerable jackson-databind, but does not expose jackson-databind in a way that would make it exploitable. As such, Red Hat will not be providing a fix for OpenDaylight at this time.
Red Hat mitigation
The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` * avoid com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool in the classpath
References (19)
- https://access.redhat.com/security/cve/CVE-2020-35728 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1911502 Issue Tracking
- https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-2450 Advisory
- https://github.com/FasterXML/jackson-databind/commit/1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84
- https://github.com/FasterXML/jackson-databind/issues/2999 x_refsource_MISCPatchThird Party Advisory
- https://github.com/advisories/GHSA-5r5r-6hpj-8gg9 Advisory
- https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 x_refsource_MISCThird Party Advisory
- https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://nvd.nist.gov/vuln/detail/CVE-2020-35728
- https://security.netapp.com/advisory/ntap-20210129-0007/ x_refsource_CONFIRMThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2020-35728
- https://www.oracle.com//security-alerts/cpujul2021.html x_refsource_MISCPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.html x_refsource_MISCThird Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISCPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISCPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISCThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISCPatchThird Party Advisory
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
GitHub