Critical · published March 3, 2020
🚨 A polymorphic deserialization flaw in FasterXML jackson-databind can let attackers execute arbitrary code by crafting malicious objects! 🔥 Think of it like a delivery service handing over packages without checking the contents — if someone sends a dangerous item labeled as 'harmless', it could wreak havoc! An attacker could slip in malicious code through deserialization, allowing them to take control of your application and potentially access sensitive data. This could lead to a full compromise of your system, making it a serious threat!
Think of it like a delivery service handing over packages without checking the contents — if someone sends a dangerous item labeled as 'harmless', it could wreak havoc! This vulnerability allows for the insecure deserialization of objects when using methods like `enableDefaultTyping()` or the `@JsonTypeInfo` annotation with certain identifiers, which can instantiate objects from untrusted sources and execute arbitrary code.
An attacker could slip in malicious code through deserialization, allowing them to take control of your application and potentially access sensitive data. This could lead to a full compromise of your system, making it a serious threat! Update your jackson-databind library to version 2.9.10 or 2.10.0 immediately to patch this vulnerability. Additionally, review your deserialization methods and ensure you only use trusted input sources. Don't forget to audit any configurations related to polymorphic type handling! You’ve got this! Fix those vulnerabilities and enhance your security today! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| fasterxml/jackson-databind | ≥ 2.8.0, < 2.8.11.5 | 2.8.11.5 |
| fasterxml/jackson-databind | ≥ 2.9.0, < 2.9.10 | 2.9.10 |
| netapp/oncommand_api_services | all versions | — |
| netapp/steelstore_cloud_integrated_storage | all versions | — |
| oracle/goldengate_stream_analytics | < 19.1.0.0.1 | 19.1.0.0.1 |