Critical · published March 2, 2020
🚨 A single malicious object can crack open your application! This flaw in jackson-databind allows for polymorphic deserialization, and it’s sneaky enough to execute arbitrary code. 🔥 Think of it as a chef receiving an order with an ingredient that isn’t what it seems. The kitchen blindly prepares the dish without verifying the recipe, ending up serving a harmful dish instead of a delicious one! An attacker could take advantage of this flaw to run any code they want on your server, potentially leading to data theft, service interruptions, or even total system compromise. This is absolutely devastating!
Think of it as a chef receiving an order with an ingredient that isn’t what it seems. The kitchen blindly prepares the dish without verifying the recipe, ending up serving a harmful dish instead of a delicious one! The vulnerability in jackson-databind allows polymorphic deserialization through malicious objects that leverage commons-configuration JNDI classes, which can lead to arbitrary code execution if exploited.
An attacker could take advantage of this flaw to run any code they want on your server, potentially leading to data theft, service interruptions, or even total system compromise. This is absolutely devastating! Upgrade jackson-databind to versions 2.9.10, 2.8.11.5, or 2.6.7.3 immediately. Ensure that your application validates all incoming data and consider implementing security measures like input sanitization to further secure your environment. You've got this! Patch things up, and you'll be one step closer to securing your app. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| fasterxml/jackson-databind | ≥ 2.9.0, < 2.9.10 | 2.9.10 |
| fasterxml/jackson-databind | ≥ 2.0.0, < 2.6.7.3 | 2.6.7.3 |
| fasterxml/jackson-databind | ≥ 2.7.0, < 2.8.11.5 | 2.8.11.5 |
| redhat/decision_manager | all versions | — |
| redhat/jboss_data_grid | all versions | — |
| redhat/jboss_data_grid | all versions | — |
| redhat/jboss_enterprise_application_platform | all versions | — |
| redhat/jboss_fuse | all versions | — |
| redhat/openshift_container_platform | all versions | — |
| redhat/process_automation | all versions | — |
| apache/geode | all versions | — |