Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix CVE–2020–9548 #12

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

debricked[bot]
Copy link

@debricked debricked bot commented Mar 4, 2022

CVE–2020–9548

Vulnerable dependency:     com.fasterxml.jackson.core:jackson-databind (Maven)    2.3.3

Vulnerability details

Description

Deserialization of Untrusted Data

The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

GitHub

jackson-databind mishandles the interaction between serialization gadgets and typing

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

NVD

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

CVSS details - 9.8

 

CVSS3 metrics
Attack Vector Network
Attack Complexity Low
Privileges Required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
References

    NVD - CVE-2020-9548
    jackson-databind mishandles the interaction between serialization gadgets and typing · CVE-2020-9548 · GitHub Advisory Database · GitHub
    Block two more gadget types (ibatis-sqlmap, anteros-core; CVE-2020-9547 / CVE-2020-9548) · Issue #2634 · FasterXML/jackson-databind · GitHub
    On Jackson CVEs: Don’t Panic — Here is what you need to know | by @cowtowncoder | Medium
    [SECURITY] [DLA 2135-1] jackson-databind security update
    MLIST
    MLIST
    MLIST
    MLIST
    MLIST
    MLIST
    MLIST
    Oracle Critical Patch Update Advisory - July 2020
    MLIST
    August 2020 FasterXML jackson-databind Vulnerabilities in NetApp Products | NetApp Product Security
    Oracle Critical Patch Update Advisory - October 2020
    Oracle Critical Patch Update Advisory - January 2021
    Block one more gadget type (shaded-hikari-config, CVE-2020-9546) · Issue #2631 · FasterXML/jackson-databind · GitHub
    Block one more gadget type (Anteros-DBCP, CVE-2020-24616) · Issue #2814 · FasterXML/jackson-databind · GitHub
    Issues · FasterXML/jackson-databind · GitHub
    Oracle Critical Patch Update Advisory - October 2021

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE

 

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants