Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
First Last Prev Next    This bug is not in your last search results.
Bug 1499182 - (CVE-2017-4995) CVE-2017-4995 Spring Security: Deserialization of untrusted data via Jackson
CVE-2017-4995 Spring Security: Deserialization of untrusted data via Jackson
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,public=20170920,repo...
: Security
Depends On: 1499183
Blocks:
  Show dependency tree / graph
 
Reported: 2017-10-06 06:08 EDT by Andrej Nemec
Modified: 2017-10-10 19:29 EDT (History)
16 users (show)

See Also:
Fixed In Version: springframework-security 4.2.3, springframework-security 5.0.0
Doc Type: If docs needed, set a value
Doc Text:
It was found that spring security uses Jackson's enableDefaultTyping() polymorphic capability for object deserialization. Jackson has already addressed this issue by blacklisting well-known gadget classes. However, under a right circumstances (e.g. an existence of an old JDK and vulnerable Jackson in classpath), an attacker could use this vulnerability to craft a malicious payload which would be deserialized by Jackson via spring security. This execution could potentially lead to remote code execution on the target machine.
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

  None (edit)
Description Andrej Nemec 2017-10-06 06:08:43 EDT 
When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets".

Spring Security configures Jackson with global default typing enabled which means that through the previous exploit, arbitrary code could be executed if all of the following is true:

--

Spring Security’s Jackson support is being leveraged by invoking SecurityJackson2Modules.getModules(ClassLoader) or SecurityJackson2Modules.enableDefaultTyping(ObjectMapper)

Jackson is used to deserialize data that is not trusted. Spring Security does not perform deserialization using Jackson, so this is an explicit choice of the user.

There is an unknown (Jackson is not blacklisting it already) “deserialization gadget” that allows code execution present on the classpath

--

Jackson provides a blacklisting approach to protecting against this type of attack, but Spring Security should be proactive against blocking unknown “deserialization gadgets” when Spring Security enables default typing.

External References:

https://pivotal.io/security/cve-2017-4995

References:

https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-31509

Upstream patches:

4.2.x https://github.com/spring-projects/spring-security/commit/947d11f433b78294942cb5ea56e8aa5c3a0ca439
5.x https://github.com/spring-projects/spring-security/commit/5dee8534cd1b92952d10cc56335b5d5856f48f3b
Comment 1 Andrej Nemec 2017-10-06 06:09:12 EDT 
Created opendaylight tracking bugs for this issue:

Affects: openstack-rdo [bug 1499183]
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.