Bug 1911502 (CVE-2020-35728)
| Summary: | CVE-2020-35728 jackson-databind: mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aboyko, aileenc, akoufoud, alazarot, almorale, anstephe, aos-bugs, asoldano, atangrin, ataylor, avibelli, bbaranow, bbuckingham, bcourt, bgeorges, bibryam, bkearney, bmaxwell, bmontgom, brian.stansberry, btofel, btotty, cdewolf, chazlett, clement.escoffier, dandread, darran.lofthouse, dbecker, dkreling, dosoudil, drieden, eleandro, eparis, eric.wittmann, etirelli, ganandan, ggaughan, gmalinko, gsmet, gvarsami, hamadhan, hbraun, hhudgeon, ibek, iweiss, janstey, java-maint-sig, java-sig-commits, jawilson, jburrell, jcantril, jcoleman, jjoyce, jochrist, jokerman, jolee, jpallich, jperkins, jross, jschatte, jschluet, jstastny, jwon, kaycoth, kconner, krathod, kverlaen, kwills, ldimaggi, lef, lgao, lhh, lpeer, lthon, lzap, mburns, mcascell, mkolesni, mmccune, mnovotny, msochure, msvehla, mszynkie, nmoumoul, nstielau, nwallace, pantinor, pdrozd, pgallagh, pjindal, pmackay, probinso, puntogil, rchan, rguimara, rhcs-maint, rjerrido, rrajasek, rruss, rstancel, rsvoboda, rsynek, rwagner, sbiarozk, sclewis, scohen, sdaley, sd-operator-metering, sdouglas, slinaber, smaestri, sokeeffe, sponnaga, sthorger, swoodman, tcunning, tkirby, tom.jenkinson, vhalbert |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | jackson-databind 2.9.10.8 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-04-27 10:47:08 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1882679, 1882680, 1882681, 1882683, 1911503, 1911584, 1911585, 1911586, 1911587, 1911588, 1911660, 1911661, 1911683, 1911684, 1911685, 1911686, 1911687, 1911688 | ||
| Bug Blocks: | 1911504 | ||
|
Description
Guilherme de Almeida Suckevicz
2020-12-29 19:48:26 UTC
Created jackson-databind tracking bugs for this issue: Affects: fedora-all [bug 1911503] External References: https://github.com/FasterXML/jackson-databind/issues/2999 https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 Mitigation: The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` * avoid com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool in the classpath This vulnerability is out of security support scope for the following products: * Red Hat JBoss BRMS 6 * Red Hat JBoss BPMS 6 * Red Hat JBoss Data Virtualization 6 * Red Hat JBoss Fuse Service Works 6 Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details. Statement: The following Red Hat Products ship jackson-databind version 2.10.0 or later which is not considered affected by this CVE (see https://medium.com/@cowtowncoder/jackson-2-10-safe-default-typing-2d018f0ce2ba) * JBoss Data Grid 7 * JBoss Data Grid 8 * Enterprise Application Platform 7 * Red Hat Decision Manager 7 * Red Hat Process Automation Manager 7 * Red Hat Single Sign-On (RH-SSO) 7 * Red Hat JBoss Fuse 7 * Red Hat JBoss A-MQ * Red Hat Enterprise Linux 8 * Red Hat Satellite 6.6 * Red Hat Satellite 6.7 * Red Hat Satellite 6.8 * Red Hat CodeReady Studio 12 Red Hat OpenShift Container Platform and Red Hat OpenStack Platform does ship the vulnerable components, but does not enable the unsafe conditions needed to exploit, lowering their vulnerability impact. In Red Hat Openshift 4 there are no plans to maintain the ose-logging-elasticsearch5 container, hence it has been marked wontfix at this time and may be fixed in a future update. Red Hat OpenStack Platform 13 ships OpenDaylight, which contains the vulnerable jackson-databind, but does not expose jackson-databind in a way that would make it exploitable. As such, Red Hat will not be providing a fix for OpenDaylight at this time. This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.6 Via RHSA-2021:1230 https://access.redhat.com/errata/RHSA-2021:1230 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-35728 |