FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sq

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• debian debian linux8.0
• fasterxml jackson-databind2.8.0 and later · before 2.8.11.6
• fasterxml jackson-databind2.9.0 and later · before 2.9.10.4
• fasterxml jackson-databind2.0.0 and later · before 2.7.9.7
• netapp active iq unified manager7.3 and later
• netapp active iq unified manager9.5 and later
• oracle autovue for agile product lifecycle management21.0.2
• oracle banking platform2.4.0 and later · up to 2.9.0 inclusive
• oracle communications contacts server8.0.0.4.0
• oracle communications evolved communications application server7.1
• oracle communications instant messaging server10.0.1.4.0
• oracle communications network charging and control12.0.0 and later · up to 12.0.3 inclusive
• oracle communications network charging and control6.0.1
• oracle enterprise manager base platform13.3.0.0
• oracle enterprise manager base platform13.4.0.0
• oracle global lifecycle management opatchbefore 12.2.0.1.20
• oracle jd edwards enterpriseone orchestratorbefore 9.2.4.2
• oracle jd edwards enterpriseone toolsbefore 9.2.4.2
• oracle primavera unifier17.7 and later · up to 17.12 inclusive
• oracle primavera unifier16.1

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2017-17485FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix
  54Plan
• CVE-2017-7525A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthentica
  50Plan
• CVE-2020-8840FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyedi
  47Plan

Published before and after this one in the same product

• ← EarlierCVE-2019-20330Jan 3, 2020 · FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
  42Plan
• ← EarlierCVE-2020-9546Mar 2, 2020 · FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.ha
  40Plan
• Later →CVE-2020-9548Mar 2, 2020 · FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.antero
  45Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Data received over the network is deserialized into the language’s native object format without verifying its source. Code paths inside the object can be triggered during deserialization.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1payload = sock.recv(65536)2job = pickle.loads(payload)

1payload = sock.recv(65536)2if not hmac.compare_digest(sign(payload), header_sig):3    raise PermissionError("invalid signature")4job = JobSchema.validate(json.loads(payload))

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.