CVE-2020-9548CWE-502insecure-deserialization

CVE-2020-9548

Critical · published March 2, 2020

CVSS v3.1
9.8
EPSS
19%
Percentile
97.3
In the wild
Unconfirmed
What it is

⚠️ A mishandling in serialization could sideline your app! This vulnerability in fasterXML jackson-databind can arise if you’re using versions before 2.9.10.4 — it’s like a recipe that doesn't follow the right mix of ingredients! 😅 Think of this vulnerability as a restaurant that serves dishes using expired ingredients without checking. Just like you wouldn't want mystery meat in your tacos, you definitely don't want improperly handled data in your app! If an attacker exploits this issue, they could potentially introduce harmful data into your system, leading to unexpected behavior or even crashing your app. While not actively exploited, the risk of improperly serialized data still poses an alarming scenario for your application’s integrity. 🔥

Put simply

Think of this vulnerability as a restaurant that serves dishes using expired ingredients without checking. Just like you wouldn't want mystery meat in your tacos, you definitely don't want improperly handled data in your app! This vulnerability occurs because jackson-databind mishandles the interaction between serialization gadgets and typing. Specifically, it allows for unsafe object deserialization related to the AnterosDBCPConfig, which could lead to various issues if leveraged by a malicious user.

What to do

If an attacker exploits this issue, they could potentially introduce harmful data into your system, leading to unexpected behavior or even crashing your app. While not actively exploited, the risk of improperly serialized data still poses an alarming scenario for your application’s integrity. 🔥 To safeguard your application, upgrade to jackson-databind version 2.9.10.4 or later immediately. Also, review your serialization practices to ensure strict controls on what data can be deserialized. Staying vigilant with updates is key! You've got this! By following these steps, you'll not only fix the issue but become a security hero! 🦸‍♂️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.18921 · 97.3th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2020-03-02T09:15Z
Affected products (46)
ProductVersionsFixed in
fasterxml/jackson-databind≥ 2.0.0, < 2.7.9.72.7.9.7
fasterxml/jackson-databind≥ 2.8.0, < 2.8.11.62.8.11.6
fasterxml/jackson-databind≥ 2.9.0, < 2.9.10.42.9.10.4
netapp/active_iq_unified_manager≥ 7.3—
netapp/active_iq_unified_manager≥ 7.3—
netapp/active_iq_unified_manager≥ 9.5—
debian/debian_linuxall versions—
oracle/agile_product_lifecycle_managementall versions—
oracle/autovue_for_agile_product_lifecycle_managementall versions—
oracle/banking_digital_experienceall versions—
oracle/banking_digital_experienceall versions—
oracle/banking_digital_experienceall versions—
oracle/banking_digital_experienceall versions—
oracle/banking_digital_experienceall versions—
oracle/banking_digital_experienceall versions—
oracle/banking_platform≥ 2.4.0, ≤ 2.9.0—
oracle/communications_calendar_serverall versions—
oracle/communications_contacts_serverall versions—
oracle/communications_contacts_serverall versions—
oracle/communications_diameter_signaling_router≥ 8.0.0, ≤ 8.2.2—
oracle/communications_element_manager≥ 8.2.0, ≤ 8.2.2—
oracle/communications_evolved_communications_application_serverall versions—
oracle/communications_instant_messaging_serverall versions—
oracle/communications_network_charging_and_control≥ 12.0.0, ≤ 12.0.3—
oracle/communications_network_charging_and_controlall versions—
oracle/communications_session_report_manager≥ 8.2.0, ≤ 8.2.2—
oracle/communications_session_route_manager≥ 8.2.0, ≤ 8.2.2—
oracle/enterprise_manager_base_platformall versions—
oracle/enterprise_manager_base_platformall versions—
oracle/global_lifecycle_management_opatch< 12.2.0.1.2012.2.0.1.20
oracle/jd_edwards_enterpriseone_orchestrator< 9.2.4.29.2.4.2
oracle/jd_edwards_enterpriseone_tools< 9.2.4.29.2.4.2
oracle/primavera_unifier≥ 17.7, ≤ 17.12—
oracle/primavera_unifierall versions—
oracle/primavera_unifierall versions—
oracle/primavera_unifierall versions—
oracle/primavera_unifierall versions—
oracle/retail_merchandising_systemall versions—
oracle/retail_sales_auditall versions—
oracle/retail_xstore_point_of_serviceall versions—
oracle/retail_xstore_point_of_serviceall versions—
oracle/retail_xstore_point_of_serviceall versions—
oracle/retail_xstore_point_of_serviceall versions—
oracle/retail_xstore_point_of_serviceall versions—
oracle/weblogic_serverall versions—
oracle/weblogic_serverall versions—
References (32)
https://github.com/FasterXML/jackson-databind/issues/2634 · [email protected]https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3E · [email protected]https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3E · [email protected]https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3E · [email protected]https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3E · [email protected]https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3E · [email protected]https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3E · [email protected]https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3E · [email protected]https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E · [email protected]https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html · [email protected]https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 · [email protected]https://security.netapp.com/advisory/ntap-20200904-0006/ · [email protected]https://www.oracle.com/security-alerts/cpujan2021.html · [email protected]https://www.oracle.com/security-alerts/cpujul2020.html · [email protected]https://www.oracle.com/security-alerts/cpuoct2020.html · [email protected]https://www.oracle.com/security-alerts/cpuoct2021.html · [email protected]https://github.com/FasterXML/jackson-databind/issues/2634 · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html · af854a3a-2127-422b-91ae-364da2661108https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20200904-0006/ · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujan2021.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujul2020.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuoct2020.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuoct2021.html · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 02 MAR 03:58Z
    FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
    cvelistv5