Bug 1913871 (CVE-2020-36179)

Summary: CVE-2020-36179 jackson-databind: mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aboyko, aileenc, akoufoud, alazarot, almorale, anstephe, aos-bugs, asoldano, atangrin, ataylor, avibelli, bbaranow, bbuckingham, bcourt, bgeorges, bibryam, bkearney, bmaxwell, bmontgom, brian.stansberry, btofel, btotty, cdewolf, chazlett, clement.escoffier, dandread, darran.lofthouse, dbecker, dkreling, dosoudil, drieden, eleandro, eparis, eric.wittmann, etirelli, ganandan, ggaughan, gmalinko, gsmet, gvarsami, hamadhan, hbraun, hhudgeon, ibek, iweiss, janstey, java-maint-sig, java-sig-commits, jawilson, jburrell, jcantril, jcoleman, jjoyce, jochrist, jokerman, jolee, jpallich, jperkins, jross, jschatte, jschluet, jstastny, jwon, kaycoth, kconner, krathod, kverlaen, kwills, ldimaggi, lef, lgao, lhh, lpeer, lthon, lzap, mburns, mkolesni, mmccune, mnovotny, msochure, msvehla, mszynkie, nmoumoul, nstielau, nwallace, pantinor, pdrozd, pgallagh, pjindal, pmackay, probinso, puntogil, rchan, rguimara, rhcs-maint, rjerrido, rrajasek, rruss, rstancel, rsvoboda, rsynek, rwagner, sbiarozk, sclewis, scohen, sdaley, sd-operator-metering, sdouglas, slinaber, smaestri, sokeeffe, sponnaga, sthorger, swoodman, tcunning, tkirby, tom.jenkinson, vhalbert
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: jackson-databind Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-04-27 10:47:20 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1882679, 1882680, 1882681, 1882683, 1914157, 1914158, 1922499    
Bug Blocks: 1913942    

Description Guilherme de Almeida Suckevicz 2021-01-07 18:53:52 UTC
FasterXML jackson-databind 2.x before mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.


Comment 4 Przemyslaw Roguski 2021-01-08 10:23:46 UTC
External References:


Comment 5 Przemyslaw Roguski 2021-01-08 10:23:57 UTC

The following conditions are needed for an exploit, we recommend avoiding all if possible:
* Deserialization from sources you do not control
* `enableDefaultTyping()`
* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`
* avoid: oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS, org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS, org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS, org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS, org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool, org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource, org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource, org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource, org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource, com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource, com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource
in the classpath

Comment 9 RaTasha Tillery-Smith 2021-01-12 18:12:54 UTC

The following Red Hat products do ship the vulnerable component, but do not enable the unsafe conditions needed to exploit, lowering their vulnerability impact:
* JBoss Data Grid 7
* Business Process Management Suite 6
* Business Rules Management Suite 6
* JBoss Data Virtualization 6
* Red Hat Fuse Service Works 6
* Red Hat OpenStack Platform
* Red Hat OpenShift containers: ose-metering-hadoop, ose-metering-hive, ose-logging-elasticsearch5, ose-logging-elasticsearch6  
These products may update the jackson-databind dependency in a future release.

In Red Hat Openshift 4 there are no plans to maintain the ose-logging-elasticsearch5 container, therefore it has been marked wontfix at this time and may be fixed in a future update. 

The following Red Hat products ship OpenDaylight, which contains the vulnerable jackson-databind, but do not expose jackson-databind in a way that would make it exploitable:
* Red Hat OpenStack Platform 13
As such, Red Hat will not be providing a fix for OpenDaylight at this time.

The following Red Hat products are not affected by this flaw because they use a more recent version of jackson-databind that does not contain the vulnerable code:
* CodeReady Studio 12.16.0
* Red Hat Enterprise Linux 8
* Red Hat Enterprise Virtualization
* Red Hat Satellite 6
* Red Hat OpenShift container: ose-metering-presto

Comment 11 msiddiqu 2021-01-29 22:08:24 UTC
Created jackson-databind tracking bugs for this issue:

Affects: fedora-all [bug 1922499]

Comment 12 errata-xmlrpc 2021-04-27 08:57:00 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.6

Via RHSA-2021:1230 https://access.redhat.com/errata/RHSA-2021:1230

Comment 13 Product Security DevOps Team 2021-04-27 10:47:20 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):