Bug 1462702 (CVE-2017-7525) - CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
Summary: CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue m...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-7525
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=important,public=20170714,repo...
Depends On: 1730588 1731780 1732539 1463712 1463713 1465739 1465740 1466196 1466197 1470820 1473260 1473261 1473264 1473265 1473299 1473300 1473301 1486844 1507701 1507702 1507830 1731787 1731789 1731790 1731792 1732286 1732291
Blocks: 1462704 1474181 1475996 1477305 1485997
TreeView+ depends on / blocked
 
Reported: 2017-06-19 11:01 UTC by Adam Mariš
Modified: 2019-07-25 09:54 UTC (History)
93 users (show)

Fixed In Version: jackson-databind 2.8.9, jackson-databind 2.9.0
Doc Type: If docs needed, set a value
Doc Text:
A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
Clone Of:
Environment:
Last Closed: 2019-06-08 03:15:02 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:1834 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 7.0.7 on RHEL 6 2017-07-31 18:59:10 UTC
Red Hat Product Errata RHSA-2017:1835 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 7.0.7 on RHEL 7 2017-07-31 18:58:11 UTC
Red Hat Product Errata RHSA-2017:1836 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 7.0.7 2017-07-31 18:47:54 UTC
Red Hat Product Errata RHSA-2017:1837 normal SHIPPED_LIVE Important: eap7-jboss-ec2-eap security update 2017-07-31 19:20:11 UTC
Red Hat Product Errata RHSA-2017:1839 normal SHIPPED_LIVE Important: rh-eclipse46-jackson-databind security update 2017-07-31 20:32:56 UTC
Red Hat Product Errata RHSA-2017:1840 normal SHIPPED_LIVE Important: devtoolset-4-jackson-databind security update 2017-07-31 20:53:10 UTC
Red Hat Product Errata RHSA-2017:2477 normal SHIPPED_LIVE Important: Red Hat JBoss Data Virtualization 6.3 Update 7 security update 2017-08-15 19:07:56 UTC
Red Hat Product Errata RHSA-2017:2546 normal SHIPPED_LIVE Important: Red Hat JBoss BPM Suite 6.4.5 security update 2017-08-29 23:40:38 UTC
Red Hat Product Errata RHSA-2017:2547 normal SHIPPED_LIVE Important: Red Hat JBoss BRMS 6.4.5 security update 2017-08-29 23:40:27 UTC
Red Hat Product Errata RHSA-2017:2633 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 6.4.17 update 2017-09-05 18:32:20 UTC
Red Hat Product Errata RHSA-2017:2635 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 6 2017-09-05 19:07:46 UTC
Red Hat Product Errata RHSA-2017:2636 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 7 2017-09-05 19:01:10 UTC
Red Hat Product Errata RHSA-2017:2637 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 5 2017-09-05 19:04:25 UTC
Red Hat Product Errata RHSA-2017:2638 normal SHIPPED_LIVE Important: jboss-ec2-eap security, bug fix, and enhancement update 2017-09-05 19:36:46 UTC
Red Hat Product Errata RHSA-2017:3141 normal SHIPPED_LIVE Important: rhvm-appliance security, bug fix, and enhancement update 2017-11-07 22:23:02 UTC
Red Hat Product Errata RHSA-2017:3454 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 7.1.0 security update 2017-12-13 22:48:09 UTC
Red Hat Product Errata RHSA-2017:3455 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 7.1.0 security update 2017-12-13 22:57:25 UTC
Red Hat Product Errata RHSA-2017:3456 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 7.1.0 security update 2017-12-13 22:31:03 UTC
Red Hat Product Errata RHSA-2017:3458 normal SHIPPED_LIVE Important: eap7-jboss-ec2-eap security update 2017-12-13 23:26:13 UTC
Red Hat Product Errata RHSA-2018:0294 normal SHIPPED_LIVE Important: Red Hat JBoss Data Grid 7.1.2 security update 2018-02-12 22:19:54 UTC
Red Hat Product Errata RHSA-2018:0342 normal SHIPPED_LIVE Important: rh-maven35-jackson-databind security update 2018-02-22 14:21:40 UTC
Red Hat Product Errata RHSA-2019:0910 None None None 2019-04-30 15:18:29 UTC

Description Adam Mariš 2017-06-19 11:01:39 UTC
A deserialization flaw in jackson-databind was found allowing code execution when given maliocusly crafted input to readValue method of ObjectMapper.

Comment 5 Adam Mariš 2017-06-21 08:34:07 UTC
Acknowledgments:

Name: Liao Xinxi (NSFOCUS)

Comment 13 Raphael Sanchez Prudencio 2017-07-20 10:43:31 UTC
Created jackson-databind tracking bugs for this issue:

Affects: fedora-all [bug 1473260]

Comment 20 errata-xmlrpc 2017-07-31 14:49:16 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2017:1836 https://access.redhat.com/errata/RHSA-2017:1836

Comment 21 errata-xmlrpc 2017-07-31 15:00:50 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7

Via RHSA-2017:1835 https://access.redhat.com/errata/RHSA-2017:1835

Comment 22 errata-xmlrpc 2017-07-31 15:01:42 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6

Via RHSA-2017:1834 https://access.redhat.com/errata/RHSA-2017:1834

Comment 23 errata-xmlrpc 2017-07-31 15:20:56 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7
  Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6

Via RHSA-2017:1837 https://access.redhat.com/errata/RHSA-2017:1837

Comment 24 errata-xmlrpc 2017-07-31 16:33:49 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2017:1839 https://access.redhat.com/errata/RHSA-2017:1839

Comment 25 errata-xmlrpc 2017-07-31 16:54:03 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2017:1840 https://access.redhat.com/errata/RHSA-2017:1840

Comment 26 errata-xmlrpc 2017-08-15 15:09:34 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Data Virtualization

Via RHSA-2017:2477 https://access.redhat.com/errata/RHSA-2017:2477

Comment 27 errata-xmlrpc 2017-08-29 19:41:36 UTC
This issue has been addressed in the following products:

  Red Hat JBoss BRMS

Via RHSA-2017:2547 https://access.redhat.com/errata/RHSA-2017:2547

Comment 28 errata-xmlrpc 2017-08-29 19:42:47 UTC
This issue has been addressed in the following products:

  Red Hat JBoss BPM Suite

Via RHSA-2017:2546 https://access.redhat.com/errata/RHSA-2017:2546

Comment 30 errata-xmlrpc 2017-09-05 14:33:38 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2017:2633 https://access.redhat.com/errata/RHSA-2017:2633

Comment 31 errata-xmlrpc 2017-09-05 15:12:59 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7

Via RHSA-2017:2636 https://access.redhat.com/errata/RHSA-2017:2636

Comment 32 errata-xmlrpc 2017-09-05 15:14:22 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5

Via RHSA-2017:2637 https://access.redhat.com/errata/RHSA-2017:2637

Comment 33 errata-xmlrpc 2017-09-05 15:15:50 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6

Via RHSA-2017:2635 https://access.redhat.com/errata/RHSA-2017:2635

Comment 34 errata-xmlrpc 2017-09-05 15:38:11 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6

Via RHSA-2017:2638 https://access.redhat.com/errata/RHSA-2017:2638

Comment 36 Doran Moppert 2017-11-07 06:43:12 UTC
Mitigation:

Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true

Comment 37 Raphael Sanchez Prudencio 2017-11-07 16:44:27 UTC
Why exactly this task has rhsa_sla flag if it's not Critical?

Comment 38 errata-xmlrpc 2017-11-07 17:32:23 UTC
This issue has been addressed in the following products:

  RHEV 4.X RHEV-H and Agents for RHEL-7

Via RHSA-2017:3141 https://access.redhat.com/errata/RHSA-2017:3141

Comment 46 errata-xmlrpc 2017-12-13 17:35:36 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2017:3456 https://access.redhat.com/errata/RHSA-2017:3456

Comment 47 errata-xmlrpc 2017-12-13 18:27:36 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6

Via RHSA-2017:3454 https://access.redhat.com/errata/RHSA-2017:3454

Comment 48 errata-xmlrpc 2017-12-13 18:43:56 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7

Via RHSA-2017:3455 https://access.redhat.com/errata/RHSA-2017:3455

Comment 49 errata-xmlrpc 2017-12-13 18:50:35 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
  Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6

Via RHSA-2017:3458 https://access.redhat.com/errata/RHSA-2017:3458

Comment 54 errata-xmlrpc 2018-02-12 17:20:20 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Data Grid

Via RHSA-2018:0294 https://access.redhat.com/errata/RHSA-2018:0294

Comment 55 errata-xmlrpc 2018-02-22 09:20:58 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS

Via RHSA-2018:0342 https://access.redhat.com/errata/RHSA-2018:0342

Comment 57 Andrej Nemec 2018-05-14 12:06:53 UTC
Statement:

This issue affects the versions of jackson-databind (in Satellite 6.0 and 6.1) and candlepin (which embeds a copy of jackson-databind in Satellite 6.2) as shipped with Red Hat Satellite 6.x. However the affected code is NOT used at this time:

Candlepin currently uses the default type resolution configuration for the ObjectMappers it creates/uses. Nowhere in candlepin do we enable global polymorphic deserialization via enableDefaultTyping(...), therefore based on the documentation sited BZ 1462702 , candlepin should not be affected.

However as the vulnerable software ships with the product we have marked them as vulnerable to ensure the issue is tracked.

JBoss EAP 7.x only uses the vulnerable Jackson Databind library for marshalling and unmarshalling of JSON objects passed to JAX-RS webservices. Some advise about how to remain safe when using JAX-RS webservices on JBoss EAP 7.x is available here: 

https://access.redhat.com/solutions/3279231

Although JBoss Fuse ships the vulnerable version of jackson-databind, it does not call on enableDefaultTyping() for any polymorphic deserialization operations which is the root cause of this vulnerability. We have raised a Jira tracker to ensure that jackson-databind will be upgraded for Fuse 7.0, however due to feasibility issues jackson-databind cannot be upgraded in JBoss Fuse 6.3.

Comment 58 errata-xmlrpc 2019-04-30 15:18:26 UTC
This issue has been addressed in the following products:

  Red Hat Fuse 7.3

Via RHSA-2019:0910 https://access.redhat.com/errata/RHSA-2019:0910


Note You need to log in before you can comment on or make changes to this bug.