CoreCVE
Back

CRITICAL

jackson-databind: Serialization gadgets in shaded-hikari-config

Published Mar 2, 2020

Description

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

Affected products

Remediation

Red Hat statement

Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time. While OpenShift Container Platform's elasticsearch plugins do ship the vulnerable component, it doesn't do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release. Red Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (32)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Mar 2, 2020
Updated Aug 4, 2024
Reserved Mar 2, 2020
Link CVE-2020-9546
CISA Vulnrichment
Updated n/a
NVD
Status Analyzed
Modified Aug 25, 2026
Link CVE-2020-9546
Red Hat
Severity Important
Public date Mar 2, 2020
Links CVE-2020-9546 - Bugzilla
GHSA-5P34-5M6P-P58G