FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration. Upstream bug: https://github.com/FasterXML/jackson-databind/issues/2798 Upstream commits: https://github.com/FasterXML/jackson-databind/commit/6cc9f1a1af323cd156f5668a47e43bab324ae16f https://github.com/FasterXML/jackson-databind/commit/ad5a630174f08d279504bc51ebba8772fd71b86b
Created jackson-databind tracking bugs for this issue: Affects: fedora-all [bug 1882313]
Mitigation: The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` * avoid com.pastdev.httpcomponents in the classpath
Upstream fix: https://github.com/FasterXML/jackson-databind/commit/6cc9f1a1af323cd156f5668a47e43bab324ae16f
All active versions of Red Hat Satellite are using 2.10.0+ (2.10.1 to be exact), hence as per https://github.com/FasterXML/jackson-databind/issues/2798#issue-658400094, version is not affected to the flaw.
Statement: The following Red Hat products do ship the vulnerable component, but do not enable the unsafe conditions needed to exploit: * JBoss Data Grid 7 * Business Process Management Suite 6 * Business Rules Management Suite 6 * JBoss Data Virtualization 6 * OpenShift Container Platform These products may update the jackson-databind dependency in a future release. The following Red Hat products ship OpenDaylight, which contains the vulnerable jackson-databind, but do not expose jackson-databind in a way that would make it exploitable * Red Hat OpenStack Platform 13 As such, Red Hat will not be providing a fix for OpenDaylight at this time. The following Red Hat products are not affected by this flaw because they use a more recent version of jackson-databind that does not contain the vulnerable code: * CodeReady Studio 12.16.0 * Red Hat Enterprise Linux 8 * Red Hat Enterprise Virtualization * Red Hat Satellite 6
We disagree with the base score of 9.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and instead believe the Attack Complexity to be higher - 8.1/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Exploitability Metrics: Attack Vector Network (AV:N) - We agree here, Jackson-databind is commonly used by applications communicating across the network(s) a common example would be serializing and deserializing content for RESTful APIs, these are generally services available outside the local network and can be routable traffic. Attack Complexity Low (AC:L) -> Attack Complexity High (AC:H): We disagree with the original scoring of a low attack complexity, we believe the impact is significantly different depending on mitigating circumstances, that is to say a successful attack depends on conditions beyond the attacker's control, we believe those conditions are - * `enableDefaultTyping()` must be enabled - This by itself is a configuration option and something we must assume is enabled for the base score, however the vector from which data deserialized is application specific and an attacker must invest some time in discovering what that is, in other words the application must be written in such a way to deserialize from untrusted sources. * The exploit gadget (`com.pastdev.httpcomponents.configuration.JndiConfiguration`) must be available on the classpath, again this is application specific and is separate from configuration, again this is another factor outside the attackers control and they must gather knowledge about the target environment Privileges Required None (PR:N) - Agree here, the attacker does not need to be a privileged user eg. no login required to exploit the base flaw. User Interaction None (UI:N) Agree here, there is no need for the attacker to coerce a user into performing actions in order to exploit this vulnerability. Scope Unchanged (S:U) Agree here, the attacker will not be able to escape the scope of the executing JVM solely due to this flaw Impact Metrics: Confidentiality High (C:H) Agree here, upon a successful exploit an attacker can access all information available to the executing JVM Integrity High (I:H) We agree here, upon a successful exploit the attacker can arbitrarily run code (RCE) limited only by the scope of the executing JVM Availability High (A:H) We agree here, again as an attacker inherits the privileges of the JVM it is possible to fully deny access to resources in the impacted component, its possible such attacks can be persistent by means of file modification.
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS Via RHSA-2020:4173 https://access.redhat.com/errata/RHSA-2020:4173
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-24750
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.7 Via RHSA-2020:5635 https://access.redhat.com/errata/RHSA-2020:5635
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.6 Via RHSA-2021:1230 https://access.redhat.com/errata/RHSA-2021:1230