Bug 1462702 (CVE-2017-7525) - CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
Summary: CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue m...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-7525
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1463712 1463713 1465739 1465740 1466196 1466197 1470820 1473260 1473261 1473264 1473265 1473299 1473300 1473301 1486844 1507701 1507702 1507830 1730588 1731780 1731787 1731789 1731790 1731792 1732286 1732291 1732539
Blocks: 1462704 1474181 1475996 1477305 1485997
TreeView+ depends on / blocked
 
Reported: 2017-06-19 11:01 UTC by Adam Mariš
Modified: 2021-12-10 15:05 UTC (History)
99 users (show)

Fixed In Version: jackson-databind 2.8.9, jackson-databind 2.9.0
Doc Type: If docs needed, set a value
Doc Text:
A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
Clone Of:
Environment:
Last Closed: 2019-06-08 03:15:02 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:1834 0 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 7.0.7 on RHEL 6 2017-07-31 18:59:10 UTC
Red Hat Product Errata RHSA-2017:1835 0 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 7.0.7 on RHEL 7 2017-07-31 18:58:11 UTC
Red Hat Product Errata RHSA-2017:1836 0 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 7.0.7 2017-07-31 18:47:54 UTC
Red Hat Product Errata RHSA-2017:1837 0 normal SHIPPED_LIVE Important: eap7-jboss-ec2-eap security update 2017-07-31 19:20:11 UTC
Red Hat Product Errata RHSA-2017:1839 0 normal SHIPPED_LIVE Important: rh-eclipse46-jackson-databind security update 2017-07-31 20:32:56 UTC
Red Hat Product Errata RHSA-2017:1840 0 normal SHIPPED_LIVE Important: devtoolset-4-jackson-databind security update 2017-07-31 20:53:10 UTC
Red Hat Product Errata RHSA-2017:2477 0 normal SHIPPED_LIVE Important: Red Hat JBoss Data Virtualization 6.3 Update 7 security update 2017-08-15 19:07:56 UTC
Red Hat Product Errata RHSA-2017:2546 0 normal SHIPPED_LIVE Important: Red Hat JBoss BPM Suite 6.4.5 security update 2017-08-29 23:40:38 UTC
Red Hat Product Errata RHSA-2017:2547 0 normal SHIPPED_LIVE Important: Red Hat JBoss BRMS 6.4.5 security update 2017-08-29 23:40:27 UTC
Red Hat Product Errata RHSA-2017:2633 0 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 6.4.17 update 2017-09-05 18:32:20 UTC
Red Hat Product Errata RHSA-2017:2635 0 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 6 2017-09-05 19:07:46 UTC
Red Hat Product Errata RHSA-2017:2636 0 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 7 2017-09-05 19:01:10 UTC
Red Hat Product Errata RHSA-2017:2637 0 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 5 2017-09-05 19:04:25 UTC
Red Hat Product Errata RHSA-2017:2638 0 normal SHIPPED_LIVE Important: jboss-ec2-eap security, bug fix, and enhancement update 2017-09-05 19:36:46 UTC
Red Hat Product Errata RHSA-2017:3141 0 normal SHIPPED_LIVE Important: rhvm-appliance security, bug fix, and enhancement update 2017-11-07 22:23:02 UTC
Red Hat Product Errata RHSA-2017:3454 0 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 7.1.0 security update 2017-12-13 22:48:09 UTC
Red Hat Product Errata RHSA-2017:3455 0 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 7.1.0 security update 2017-12-13 22:57:25 UTC
Red Hat Product Errata RHSA-2017:3456 0 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 7.1.0 security update 2017-12-13 22:31:03 UTC
Red Hat Product Errata RHSA-2017:3458 0 normal SHIPPED_LIVE Important: eap7-jboss-ec2-eap security update 2017-12-13 23:26:13 UTC
Red Hat Product Errata RHSA-2018:0294 0 normal SHIPPED_LIVE Important: Red Hat JBoss Data Grid 7.1.2 security update 2018-02-12 22:19:54 UTC
Red Hat Product Errata RHSA-2018:0342 0 normal SHIPPED_LIVE Important: rh-maven35-jackson-databind security update 2018-02-22 14:21:40 UTC
Red Hat Product Errata RHSA-2019:0910 0 None None None 2019-04-30 15:18:29 UTC
Red Hat Product Errata RHSA-2019:2858 0 None None None 2019-09-27 00:13:40 UTC
Red Hat Product Errata RHSA-2019:3149 0 None None None 2019-10-18 19:52:24 UTC

Description Adam Mariš 2017-06-19 11:01:39 UTC 
A deserialization flaw in jackson-databind was found allowing code execution when given maliocusly crafted input to readValue method of ObjectMapper.
Comment 5 Adam Mariš 2017-06-21 08:34:07 UTC 
Acknowledgments:

Name: Liao Xinxi (NSFOCUS)
Comment 13 Raphael Sanchez Prudencio 2017-07-20 10:43:31 UTC 
Created jackson-databind tracking bugs for this issue:

Affects: fedora-all [bug 1473260]
Comment 20 errata-xmlrpc 2017-07-31 14:49:16 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2017:1836 https://access.redhat.com/errata/RHSA-2017:1836
Comment 21 errata-xmlrpc 2017-07-31 15:00:50 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7

Via RHSA-2017:1835 https://access.redhat.com/errata/RHSA-2017:1835
Comment 22 errata-xmlrpc 2017-07-31 15:01:42 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6

Via RHSA-2017:1834 https://access.redhat.com/errata/RHSA-2017:1834
Comment 23 errata-xmlrpc 2017-07-31 15:20:56 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7
  Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6

Via RHSA-2017:1837 https://access.redhat.com/errata/RHSA-2017:1837
Comment 24 errata-xmlrpc 2017-07-31 16:33:49 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2017:1839 https://access.redhat.com/errata/RHSA-2017:1839
Comment 25 errata-xmlrpc 2017-07-31 16:54:03 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2017:1840 https://access.redhat.com/errata/RHSA-2017:1840
Comment 26 errata-xmlrpc 2017-08-15 15:09:34 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Data Virtualization

Via RHSA-2017:2477 https://access.redhat.com/errata/RHSA-2017:2477
Comment 27 errata-xmlrpc 2017-08-29 19:41:36 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss BRMS

Via RHSA-2017:2547 https://access.redhat.com/errata/RHSA-2017:2547
Comment 28 errata-xmlrpc 2017-08-29 19:42:47 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss BPM Suite

Via RHSA-2017:2546 https://access.redhat.com/errata/RHSA-2017:2546
Comment 30 errata-xmlrpc 2017-09-05 14:33:38 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2017:2633 https://access.redhat.com/errata/RHSA-2017:2633
Comment 31 errata-xmlrpc 2017-09-05 15:12:59 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7

Via RHSA-2017:2636 https://access.redhat.com/errata/RHSA-2017:2636
Comment 32 errata-xmlrpc 2017-09-05 15:14:22 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5

Via RHSA-2017:2637 https://access.redhat.com/errata/RHSA-2017:2637
Comment 33 errata-xmlrpc 2017-09-05 15:15:50 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6

Via RHSA-2017:2635 https://access.redhat.com/errata/RHSA-2017:2635
Comment 34 errata-xmlrpc 2017-09-05 15:38:11 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6

Via RHSA-2017:2638 https://access.redhat.com/errata/RHSA-2017:2638
Comment 36 Doran Moppert 2017-11-07 06:43:12 UTC 
Mitigation:

Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Comment 37 Raphael Sanchez Prudencio 2017-11-07 16:44:27 UTC 
Why exactly this task has rhsa_sla flag if it's not Critical?
Comment 38 errata-xmlrpc 2017-11-07 17:32:23 UTC 
This issue has been addressed in the following products:

  RHEV 4.X RHEV-H and Agents for RHEL-7

Via RHSA-2017:3141 https://access.redhat.com/errata/RHSA-2017:3141
Comment 46 errata-xmlrpc 2017-12-13 17:35:36 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2017:3456 https://access.redhat.com/errata/RHSA-2017:3456
Comment 47 errata-xmlrpc 2017-12-13 18:27:36 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6

Via RHSA-2017:3454 https://access.redhat.com/errata/RHSA-2017:3454
Comment 48 errata-xmlrpc 2017-12-13 18:43:56 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7

Via RHSA-2017:3455 https://access.redhat.com/errata/RHSA-2017:3455
Comment 49 errata-xmlrpc 2017-12-13 18:50:35 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
  Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6

Via RHSA-2017:3458 https://access.redhat.com/errata/RHSA-2017:3458
Comment 54 errata-xmlrpc 2018-02-12 17:20:20 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Data Grid

Via RHSA-2018:0294 https://access.redhat.com/errata/RHSA-2018:0294
Comment 55 errata-xmlrpc 2018-02-22 09:20:58 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS

Via RHSA-2018:0342 https://access.redhat.com/errata/RHSA-2018:0342
Comment 57 Andrej Nemec 2018-05-14 12:06:53 UTC 
Statement:

This issue affects the versions of jackson-databind (in Satellite 6.0 and 6.1) and candlepin (which embeds a copy of jackson-databind in Satellite 6.2) as shipped with Red Hat Satellite 6.x. However the affected code is NOT used at this time:

Candlepin currently uses the default type resolution configuration for the ObjectMappers it creates/uses. Nowhere in candlepin do we enable global polymorphic deserialization via enableDefaultTyping(...), therefore based on the documentation sited BZ 1462702 , candlepin should not be affected.

However as the vulnerable software ships with the product we have marked them as vulnerable to ensure the issue is tracked.

JBoss EAP 7.x only uses the vulnerable Jackson Databind library for marshalling and unmarshalling of JSON objects passed to JAX-RS webservices. Some advise about how to remain safe when using JAX-RS webservices on JBoss EAP 7.x is available here: 

https://access.redhat.com/solutions/3279231

Although JBoss Fuse ships the vulnerable version of jackson-databind, it does not call on enableDefaultTyping() for any polymorphic deserialization operations which is the root cause of this vulnerability. We have raised a Jira tracker to ensure that jackson-databind will be upgraded for Fuse 7.0, however due to feasibility issues jackson-databind cannot be upgraded in JBoss Fuse 6.3.
Comment 58 errata-xmlrpc 2019-04-30 15:18:26 UTC 
This issue has been addressed in the following products:

  Red Hat Fuse 7.3

Via RHSA-2019:0910 https://access.redhat.com/errata/RHSA-2019:0910
Comment 70 errata-xmlrpc 2019-09-27 00:13:36 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.1

Via RHSA-2019:2858 https://access.redhat.com/errata/RHSA-2019:2858
Comment 71 errata-xmlrpc 2019-10-18 19:52:19 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.11

Via RHSA-2019:3149 https://access.redhat.com/errata/RHSA-2019:3149
Note You need to log in before you can comment on or make changes to this bug.