Insecure deserialization In com.fasterxml.jackson.core:jackson-databind
Description
Polymorphic Typing in FasterXML jackson-databind A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 2.9.10.1, 2.8.11.5, 2.6.7.3 | ||
 debian 11 | 2.10.0-2 | ||
debian 12 | 2.10.0-2 | ||
debian 13 | 2.10.0-2 | ||
debian 14 | 2.10.0-2 | ||
 rpm rhel8 | 0:10.8.3-1.module+el8.2.0+5925+bad5981a |
Aliases
References