Find, fix and prevent vulnerabilities in your code.

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the _findDeserializer() method of TypeDeserializerBase, which caches every unknown type ID as a distinct key in the _deserializers map even when all of them resolve to the same defaultImpl fallback. An attacker can grow that cache without bound for the lifetime of the process, exhausting memory over time, by submitting a stream of novel type identifiers. This requires the application to use name-based polymorphism through @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), to accept attacker-controlled type identifiers, and to reuse the mapper instance across requests.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.11, 2.21.7, 2.22.3 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Issue

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the BeanDeserializerBase.createContextual() method, which applies the per-property exclusions through _handleByNameInclusion() and then rebuilds the property map from the unfiltered original, overwriting the filtered map and restoring every property the exclusion had removed. An attacker can set fields that were marked ignored, enabling mass assignment, by supplying those property names in untrusted JSON during deserialization. Exploitation requires case-insensitive property matching to be enabled via @JsonFormat with ACCEPT_CASE_INSENSITIVE_PROPERTIES alongside per-property @JsonIgnoreProperties.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.9, 2.21.5, 2.22.1 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Issue
• GitHub Issue

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the POJOPropertiesCollector._removeUnwantedIgnorals process. An attacker can access or modify properties that were intended to be ignored by supplying JSON input with keys matching the renamed property names, thereby bypassing intended access restrictions.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.8, 2.21.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the JDKFromStringDeserializer class, which constructs InetSocketAddress and resolves the hostname through DNS at deserialization time. An attacker can force the server to issue outbound DNS lookups for chosen hostnames by submitting JSON that is deserialized into a type holding an InetSocketAddress field, with no authentication required. The observable effect is limited to DNS resolution of attacker-chosen names, useful for out-of-band interaction or internal resolver probing rather than a full outbound request, and it applies only where the application deserializes untrusted JSON into types containing such fields.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.8, 2.21.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the STD_INET_ADDRESS branch in FromStringDeserializer in src/main/java/com/fasterxml/jackson/databind/deser/std/FromStringDeserializer.java. An attacker can trigger outbound DNS lookups and blind SSRF behavior by supplying a hostname string in JSON that is deserialized into java.net.InetAddress. When application code binds untrusted input into an InetAddress field or type, the deserializer calls InetAddress.getByName(value) on the attacker-controlled string and resolves it before any application validation runs. This lets an attacker force DNS-based callbacks or probe internal hostnames, causing unwanted network egress and leaking resolver-visible information.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.9, 2.21.5, 2.22.1 or higher.

References

• GitHub Commit jackson-databind-2.21.1
• GitHub Commit jackson-databind-3.2.1
• Maintainer's Advisory

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') through NioPathDeserializer in src/main/java/com/fasterxml/jackson/databind/ext/NioPathDeserializer.java. An attacker can force readValue() to resolve an attacker-controlled java.nio.file.Path URI by supplying a non-file scheme such as jar:, http:, s3:, or a custom provider scheme in untrusted JSON. That input reaches new URI(value) and then Path.of(uri), which falls back to ServiceLoader<FileSystemProvider> resolution and can invoke a matching provider’s getPath(uri) during deserialization. The result is unintended provider loading and provider-driven path handling inside the application, which can trigger denial of service or other side effects depending on what FileSystemProvider implementations are present on the classpath.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.10, 2.21.6, 2.22.2 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub PR
• Maintainer's Advisory

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the isSafeSubType() method of DefaultBaseTypeLimitingValidator, whose denylist of unsafe base types omits java.lang.Comparable, so the method returns true for any subtype resolved under a Comparable base. An attacker can trigger instantiation of arbitrary classes that implement Comparable, such as java.io.File to reach path-traversal primitives, by sending JSON with attacker-controlled type identifiers. This requires the application to use a bare @JsonTypeInfo with the default validator and no explicit PolymorphicTypeValidator, and a property or class whose declared base type is Comparable.

Workaround

This vulnerability can be avoided by configuring an explicit restrictive PolymorphicTypeValidator, such as a BasicPolymorphicTypeValidator allowlist passed to activateDefaultTyping(), instead of relying on the default validator.

Note: The discoverer of this vulnerability reports that "I have not identified a class implementing Comparable that yields code execution purely through deserialization".

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.10, 2.21.6, 2.22.2 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Issue
• GitHub PR

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Incorrect Authorization in the deserializeUsingPropertyBasedWithExternalTypeId file. An attacker can populate restricted creator properties from untrusted input by crafting JSON that exploits the lack of view checks on parameters annotated with both @JsonView and @JsonTypeInfo(include=As.EXTERNAL_PROPERTY). This allows unauthorized assignment of sensitive fields, even when a restrictive view is active, by injecting values through polymorphic type information.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.9, 2.21.5 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit