Bug 1506612 (CVE-2017-15095)
| Summary: | CVE-2017-15095 jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Adam Mariš <amaris> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | abhgupta, ahardin, aileenc, alazarot, anstephe, aos-bugs, bcourt, bkearney, bleanhar, bmaxwell, bmcclain, bmontgom, cbillett, ccoleman, cdewolf, chazlett, csutherl, darran.lofthouse, dblechte, dedgar, dimitris, dmoppert, dosoudil, drusso, eedri, eparis, etirelli, fgavrilo, hhorak, ibek, java-sig-commits, jawilson, jburrell, jcantril, jcoleman, jgoulding, jmadigan, jmatthew, jokerman, jolee, jondruse, jorton, jshepherd, jstastny, kpiwko, kverlaen, lef, lgao, lgriffin, loleary, lpetrovi, lsurette, mchappel, mgoldboi, miburman, michal.skrivanek, mmccune, mrike, myarboro, ngough, nstielau, nwallace, ohadlevy, paradhya, pbraun, pgier, pjurak, ppalaga, psakar, pslavice, psotirop, puntogil, pwright, Rhev-m-bugs, rnetuka, rrajasek, rstancel, rsvoboda, rsynek, rzhang, sdaley, security-response-team, sfowler, sherold, spinder, sponnaga, srevivo, theute, tiwillia, tomckay, tsanders, twalsh, vhalbert, vkadlcik, vtunka, ykaul |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | jackson-databind 2.8.10, jackson-databind-2.9.2 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-08 03:29:58 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1506725, 1506726, 1507388, 1507389, 1507699, 1507700, 1507701, 1507702, 1507703, 1508703, 1510363, 1515023, 1527998, 1527999, 1730588, 1731780, 1731787, 1731789, 1731790, 1731792, 1732286, 1732291, 1732539 | ||
| Bug Blocks: | 1503101 | ||
|
Description
Adam Mariš
2017-10-26 12:52:37 UTC
Acknowledgments: Name: Liao Xinxi (NSFOCUS) Other distributions may have made the same mistake, since the original upstream ticket was closed before additional names were added to the blacklist. Original ticket + patches (CVE-2017-7525): https://github.com/FasterXML/jackson-databind/issues/1599 https://github.com/FasterXML/jackson-databind/commit/60d459ce https://github.com/FasterXML/jackson-databind/commit/3bfbb835 Further tickets and patches to block more dangerous types (I think these are all): https://github.com/FasterXML/jackson-databind/issues/1680 https://github.com/FasterXML/jackson-databind/issues/1723 https://github.com/FasterXML/jackson-databind/issues/1737 https://github.com/FasterXML/jackson-databind/commit/e8f043d1 https://github.com/FasterXML/jackson-databind/commit/ddfddfba This CVE-2017-15095 should be considered to include everything in NO_DESER_CLASS_NAMES as of today: https://github.com/FasterXML/jackson-databind/blob/7093008aa2afe8068e120df850189ae072dfa1b2/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java#L43 Created jackson-databind tracking bugs for this issue: Affects: fedora-all [bug 1508703] Mitigation: Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true This issue has been addressed in the following products: Red Hat Developer Tools Via RHSA-2017:3189 https://access.redhat.com/errata/RHSA-2017:3189 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Via RHSA-2017:3190 https://access.redhat.com/errata/RHSA-2017:3190 Statement: This issue affects the versions of jackson-databind (in Satellite 6.0 and 6.1) and candlepin (which embeds a copy of jackson-databind in Satellite 6.2) as shipped with Red Hat Satellite 6.x. However the affected code is NOT used at this time: Candlepin currently uses the default type resolution configuration for the ObjectMappers it creates/uses. Nowhere in candlepin do we enable global polymorphic deserialization via enableDefaultTyping(...), therefore based on the documentation sited BZ 1462702 , candlepin should not be affected. However as the vulnerable software ships with the product we have marked them as vulnerable to ensure the issue is tracked. JBoss EAP 7.x only uses the vulnerable Jackson Databind library for marshalling and unmarshalling of JSON objects passed to JAX-RS webservices. Some advise about how to remain safe when using JAX-RS webservices on JBoss EAP 7.x is available here: https://access.redhat.com/solutions/3279231 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Via RHSA-2018:0342 https://access.redhat.com/errata/RHSA-2018:0342 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2018:0478 https://access.redhat.com/errata/RHSA-2018:0478 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Via RHSA-2018:0480 https://access.redhat.com/errata/RHSA-2018:0480 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Via RHSA-2018:0479 https://access.redhat.com/errata/RHSA-2018:0479 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Via RHSA-2018:0481 https://access.redhat.com/errata/RHSA-2018:0481 This issue has been addressed in the following products: Red Hat Decision Manager Via RHSA-2018:0576 https://access.redhat.com/errata/RHSA-2018:0576 This issue has been addressed in the following products: Red Hat Business Automation Via RHSA-2018:0577 https://access.redhat.com/errata/RHSA-2018:0577 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2018:1447 https://access.redhat.com/errata/RHSA-2018:1447 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Via RHSA-2018:1448 https://access.redhat.com/errata/RHSA-2018:1448 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Via RHSA-2018:1449 https://access.redhat.com/errata/RHSA-2018:1449 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Via RHSA-2018:1450 https://access.redhat.com/errata/RHSA-2018:1450 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Via RHSA-2018:1451 https://access.redhat.com/errata/RHSA-2018:1451 External References: https://access.redhat.com/solutions/3442891 This issue has been addressed in the following products: Red Hat Satellite 6.4 for RHEL 7 Via RHSA-2018:2927 https://access.redhat.com/errata/RHSA-2018:2927 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.1 Via RHSA-2019:2858 https://access.redhat.com/errata/RHSA-2019:2858 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.11 Via RHSA-2019:3149 https://access.redhat.com/errata/RHSA-2019:3149 This issue has been addressed in the following products: Red Hat Fuse 7.5.0 Via RHSA-2019:3892 https://access.redhat.com/errata/RHSA-2019:3892 |