Critical · published February 11, 2020
⚠️ A missed security check in FasterXML's jackson-databind library could let attackers tap into JNDI resources—it’s like leaving the back door open at a tech conference! 🔓 Think of it as a hotel where you forgot to check IDs at the front desk, allowing anyone to waltz in and access the VIP lounge. This vulnerability lets untrusted inputs potentially hit your internal systems without proper scrutiny. An attacker could exploit this flaw to access sensitive JNDI resources, potentially leading to unauthorized data exposure or system manipulation. While it hasn't been widely exploited yet, the cracks in security can pave the way for future attacks, making this a vulnerability to keep an eye on.
Think of it as a hotel where you forgot to check IDs at the front desk, allowing anyone to waltz in and access the VIP lounge. This vulnerability lets untrusted inputs potentially hit your internal systems without proper scrutiny. This vulnerability arises from the lack of JNDI blocking in jackson-databind versions 2.0.0 to 2.9.10.2, specifically in how org.apache.xbean.propertyeditor.JndiConverter processes untrusted input. It allows potential access to internal JNDI resources without proper validation.
An attacker could exploit this flaw to access sensitive JNDI resources, potentially leading to unauthorized data exposure or system manipulation. While it hasn't been widely exploited yet, the cracks in security can pave the way for future attacks, making this a vulnerability to keep an eye on. Upgrade jackson-databind to version 2.9.10.3 or later to ensure JNDI blocking is enforced. Additionally, review your code to ensure untrusted inputs are handled safely and consider implementing additional security checks to prevent misuse. You've got this! By following these steps, you'll be one step closer to tightening your security and keeping the bad guys out. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| fasterxml/jackson-databind | ≥ 2.0.0, < 2.7.9.7 | 2.7.9.7 |
| fasterxml/jackson-databind | ≥ 2.8.0, < 2.8.11.5 | 2.8.11.5 |
| fasterxml/jackson-databind | ≥ 2.9.0, < 2.9.10.3 | 2.9.10.3 |
| debian/debian_linux | all versions | — |
| netapp/oncommand_api_services | all versions | — |
| netapp/oncommand_workflow_automation | all versions | — |
| netapp/service_level_manager | all versions | — |
| netapp/steelstore_cloud_integrated_storage | all versions | — |
| huawei/oceanstor_9000_firmware | all versions | — |
| huawei/oceanstor_9000_firmware | all versions | — |
| huawei/oceanstor_9000_firmware | all versions | — |
| huawei/oceanstor_9000_firmware | all versions | — |
| oracle/global_lifecycle_management_opatch | < 11.2.0.3.23 | 11.2.0.3.23 |
| oracle/global_lifecycle_management_opatch | ≥ 12.2.0.1.0, < 12.2.0.1.19 | 12.2.0.1.19 |
| oracle/global_lifecycle_management_opatch | ≥ 13.9.4.0.0, < 13.9.4.2.1 | 13.9.4.2.1 |