ging/fiware-cosmos-orion-spark-connector:pom.xml

Vulnerabilities

84 via 1382 paths

Dependencies

140

Source

GitHub

Commit

7aeeed24

Find, fix and prevent vulnerabilities in your code.

Severity
  • 56
  • 26
  • 2
Status
  • 84
  • 0
  • 0

high severity

Deserialization of Untrusted Data

  • Vulnerable module: log4j:log4j
  • Introduced through: log4j:log4j@1.2.17, org.slf4j:slf4j-log4j12@1.7.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.zookeeper:zookeeper@3.4.6 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.zookeeper:zookeeper@3.4.6 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.zookeeper:zookeeper@3.4.6 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.zookeeper:zookeeper@3.4.6 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-hdfs@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.zookeeper:zookeeper@3.4.6 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.apache.hadoop:hadoop-auth@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-hdfs@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.apache.hadoop:hadoop-auth@2.6.5 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.apache.hadoop:hadoop-auth@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.apache.hadoop:hadoop-auth@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.apache.hadoop:hadoop-auth@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.apache.hadoop:hadoop-auth@2.6.5 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.apache.hadoop:hadoop-auth@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.apache.hadoop:hadoop-auth@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6 org.slf4j:slf4j-log4j12@1.7.7 log4j:log4j@1.2.17

Overview

log4j:log4j is a the 1.x branch of the Apache Log4j project.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker to control the state or the flow of the execution.

Java deserialization issues have been known for years. However, interest in the issue intensified greatly in 2015, when classes that could be abused to achieve remote code execution were found in a popular library (Apache Commons Collection). These classes were used in zero-days affecting IBM WebSphere, Oracle WebLogic and many other products.

An attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.

Developers put too much trust in Java Object Serialization. Some even de-serialize objects pre-authentication. When deserializing an Object in Java you typically cast it to an expected type, and therefore Java's strict type system will ensure you only get valid object trees. Unfortunately, by the time the type checking happens, platform code has already created and executed significant logic. So, before the final type is checked a lot of code is executed from the readObject() methods of various objects, all of which is out of the developer's control. By combining the readObject() methods of various classes which are available on the classpath of the vulnerable application an attacker can execute functions (including calling Runtime.exec() to execute local OS commands).

  • Apache Blog

Remediation

There is no fixed version for log4j:log4j.

References

high severity

Arbitrary Code Execution

  • Vulnerable module: org.apache.spark:spark-core_2.11
  • Introduced through: org.apache.spark:spark-core_2.11@2.4.7 and org.apache.spark:spark-streaming_2.11@2.4.7

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7

Overview

org.apache.spark:spark-core_2.11 is a cluster computing system for Big Data.

Affected versions of this package are vulnerable to Arbitrary Code Execution. The standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The master itself does not, by design, execute user code. A specially-crafted request to the master can, however, cause the master to execute code too.

Note that this does not affect standalone clusters with authentication enabled. While the master host typically has less outbound access to other resources than a worker, the execution of code on the master is nevertheless unexpected.

Remediation

There is no fixed version for org.apache.spark:spark-core_2.11.

References

high severity

Integer Overflow

  • Vulnerable module: com.google.protobuf:protobuf-java
  • Introduced through: com.google.protobuf:protobuf-java@2.5.0, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 com.google.protobuf:protobuf-java@2.5.0
    Remediation: Upgrade to com.google.protobuf:protobuf-java@3.4.0.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-hdfs@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-hdfs@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.hadoop:hadoop-yarn-api@2.6.5 com.google.protobuf:protobuf-java@2.5.0

Overview

com.google.protobuf:protobuf-java is a Google's language-neutral, platform-neutral, extensible mechanism for serializing structured data.

Affected versions of this package are vulnerable to Integer Overflow by allowing remote authenticated attackers to cause a heap-based buffer overflow in serialisation process.

Remediation

Upgrade com.google.protobuf:protobuf-java to version 3.4.0 or higher.

References

high severity

XML External Entity (XXE) Injection

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.11.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. A flaw was found in FasterXML Jackson Databind, where it does not have entity expansion secured properly in the DOMDeserializer class. The highest threat from this vulnerability is data integrity.

Details

XXE Injection is a type of attack against an application that parses XML input. XML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.

Attacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.

For example, below is a sample XML document, containing an XML element- username.

<?xml version="1.0" encoding="ISO-8859-1"?>
   <username>John</username>
</xml>

An external XML entity - xxe, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of /etc/passwd and display it to the user rendered by username.

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
   <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
   <username>&xxe;</username>
</xml>

Other XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.7, 2.10.5.1 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.6 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It mishandles the interaction between serialization gadgets and typing, related to the class ignite-jta.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.4 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.11.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker to control the state or the flow of the execution.

Java deserialization issues have been known for years. However, interest in the issue intensified greatly in 2015, when classes that could be abused to achieve remote code execution were found in a popular library (Apache Commons Collection). These classes were used in zero-days affecting IBM WebSphere, Oracle WebLogic and many other products.

An attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.

Developers put too much trust in Java Object Serialization. Some even de-serialize objects pre-authentication. When deserializing an Object in Java you typically cast it to an expected type, and therefore Java's strict type system will ensure you only get valid object trees. Unfortunately, by the time the type checking happens, platform code has already created and executed significant logic. So, before the final type is checked a lot of code is executed from the readObject() methods of various objects, all of which is out of the developer's control. By combining the readObject() methods of various classes which are available on the classpath of the vulnerable application an attacker can execute functions (including calling Runtime.exec() to execute local OS commands).

  • Apache Blog

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.11.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker to control the state or the flow of the execution.

Java deserialization issues have been known for years. However, interest in the issue intensified greatly in 2015, when classes that could be abused to achieve remote code execution were found in a popular library (Apache Commons Collection). These classes were used in zero-days affecting IBM WebSphere, Oracle WebLogic and many other products.

An attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.

Developers put too much trust in Java Object Serialization. Some even de-serialize objects pre-authentication. When deserializing an Object in Java you typically cast it to an expected type, and therefore Java's strict type system will ensure you only get valid object trees. Unfortunately, by the time the type checking happens, platform code has already created and executed significant logic. So, before the final type is checked a lot of code is executed from the readObject() methods of various objects, all of which is out of the developer's control. By combining the readObject() methods of various classes which are available on the classpath of the vulnerable application an attacker can execute functions (including calling Runtime.exec() to execute local OS commands).

  • Apache Blog

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.11.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.11.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.11.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.11.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.11.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.11.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.11.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.11.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.11.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.11.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.11.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.11.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.11.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. A malicious user could perform a SSRF attack via the javax.swing gadget (specifically javax.swing.JTextPane).

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker to control the state or the flow of the execution.

Java deserialization issues have been known for years. However, interest in the issue intensified greatly in 2015, when classes that could be abused to achieve remote code execution were found in a popular library (Apache Commons Collection). These classes were used in zero-days affecting IBM WebSphere, Oracle WebLogic and many other products.

An attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.

Developers put too much trust in Java Object Serialization. Some even de-serialize objects pre-authentication. When deserializing an Object in Java you typically cast it to an expected type, and therefore Java's strict type system will ensure you only get valid object trees. Unfortunately, by the time the type checking happens, platform code has already created and executed significant logic. So, before the final type is checked a lot of code is executed from the readObject() methods of various objects, all of which is out of the developer's control. By combining the readObject() methods of various classes which are available on the classpath of the vulnerable application an attacker can execute functions (including calling Runtime.exec() to execute local OS commands).

  • Apache Blog

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.7 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to an incomplete black list (incomplete fix for CVE-2017-7525). This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.8.11, 2.9.4 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to an incomplete black list (incomplete fix for CVE-2017-7525 and CVE-2017-17485). This is exploitable via two different gadgets that bypass a blacklist.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.8.11, 2.9.4 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.5, 2.8.11.1, 2.9.5 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.9.1, 2.8.11.4, 2.7.9.6 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data which allows attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.9.1, 2.8.11.4, 2.7.9.6 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. SubTypeValidator.java mishandles default typing when ehcache is used, leading to remote code execution.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.9.2, 2.8.11.4, 2.7.9.6 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. A Polymorphic Typing issue was discovered related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. When Default Typing is enabled for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.1 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. Two additional net.sf.ehcache gadgets are not blacklisted.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.2 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to an incomplete black list (incomplete fix for CVE-2017-7525). It lacks xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.7.9.7, 2.8.11.5, 2.9.10.3 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. Mishandles the interaction between serialization gadgets and typing, related to:

  • com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap)
  • br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core)
  • org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config)

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.7.9.7, 2.8.11.6, 2.9.10.4 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).

Note: This vulnerability does not affect release 2.10.0 onward.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.4 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).

Note: This vulnerability does not affect release 2.10.0 onward.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.4 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to gadget javax.swing.JEditorPane.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.7.9.7, 2.8.11.6, 2.9.10.4 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to gadget org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.4 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It mishandles the interaction between serialization gadgets and typing, related to gadget org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.4 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It mishandles the interaction between serialization gadgets and typing, related to gadgets org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.4 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It mishandles the interaction between serialization gadgets and typing, related to gadget org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.4 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.4 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.4 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It is possible to conduct a Deserialization attack using the com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (xalan2) class gadget if polymorphic type handling is enabled and an application using this package allows user input which gets deserialized.

Note: This vulnerability does not affect release 2.10.0 onward.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.5 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.5 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It is possible to conduct a Deserialization attack using the oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (apache/drill) class gadget if polymorphic type handling is enabled and an application using this package allows user input which gets deserialized.

Note: This vulnerability does not affect release 2.10.0 onward.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.5 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It is possible to conduct a Deserialization attack using any of the following class gadget available within weblogic/oracle-aqjms if polymorphic type handling is enabled and an application using this package allows user input which gets deserialized.

  • oracle.jms.AQjmsQueueConnectionFactory
  • oracle.jms.AQjmsXATopicConnectionFactory
  • oracle.jms.AQjmsTopicConnectionFactory
  • oracle.jms.AQjmsXAQueueConnectionFactory
  • oracle.jms.AQjmsXAConnectionFactory

Note: This vulnerability does not affect release 2.10.0 onward.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.5 or higher.

References

high severity

Deserialization of Untrusted Data

  • Vulnerable module: com.fasterxml.jackson.core:jackson-databind
  • Introduced through: org.json4s:json4s-jackson_2.11@3.6.10, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
    Remediation: Upgrade to org.json4s:json4s-jackson_2.11@3.6.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 com.fasterxml.jackson.module:jackson-module-scala_2.11@2.6.7.1 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 io.dropwizard.metrics:metrics-json@3.1.5 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-kvstore_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.spark:spark-network-common_2.11@2.4.7 com.fasterxml.jackson.core:jackson-databind@2.6.7.3
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.json4s:json4s-jackson_2.11@3.6.10 com.fasterxml.jackson.core:jackson-databind@2.6.7.3

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker to control the state or the flow of the execution.

Java deserialization issues have been known for years. However, interest in the issue intensified greatly in 2015, when classes that could be abused to achieve remote code execution were found in a popular library (Apache Commons Collection). These classes were used in zero-days affecting IBM WebSphere, Oracle WebLogic and many other products.

An attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.

Developers put too much trust in Java Object Serialization. Some even de-serialize objects pre-authentication. When deserializing an Object in Java you typically cast it to an expected type, and therefore Java's strict type system will ensure you only get valid object trees. Unfortunately, by the time the type checking happens, platform code has already created and executed significant logic. So, before the final type is checked a lot of code is executed from the readObject() methods of various objects, all of which is out of the developer's control. By combining the readObject() methods of various classes which are available on the classpath of the vulnerable application an attacker can execute functions (including calling Runtime.exec() to execute local OS commands).

  • Apache Blog

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.6 or higher.

References

high severity
new

Deserialization of Untrusted Data

  • Vulnerable module: com.google.code.gson:gson
  • Introduced through: org.apache.spark:spark-core_2.11@2.4.7 and org.apache.spark:spark-streaming_2.11@2.4.7

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 com.google.code.gson:gson@2.2.4
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 com.google.code.gson:gson@2.2.4

Overview

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker to control the state or the flow of the execution.

Java deserialization issues have been known for years. However, interest in the issue intensified greatly in 2015, when classes that could be abused to achieve remote code execution were found in a popular library (Apache Commons Collection). These classes were used in zero-days affecting IBM WebSphere, Oracle WebLogic and many other products.

An attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.

Developers put too much trust in Java Object Serialization. Some even de-serialize objects pre-authentication. When deserializing an Object in Java you typically cast it to an expected type, and therefore Java's strict type system will ensure you only get valid object trees. Unfortunately, by the time the type checking happens, platform code has already created and executed significant logic. So, before the final type is checked a lot of code is executed from the readObject() methods of various objects, all of which is out of the developer's control. By combining the readObject() methods of various classes which are available on the classpath of the vulnerable application an attacker can execute functions (including calling Runtime.exec() to execute local OS commands).

  • Apache Blog

Remediation

Upgrade com.google.code.gson:gson to version 2.8.9 or higher.

References

high severity

Information Exposure

  • Vulnerable module: io.netty:netty
  • Introduced through: io.netty:netty@3.6.2.Final and org.apache.zookeeper:zookeeper@3.4.6

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 io.netty:netty@3.6.2.Final
    Remediation: Upgrade to io.netty:netty@3.9.8.Final.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.zookeeper:zookeeper@3.4.6 io.netty:netty@3.6.2.Final
    Remediation: Upgrade to org.apache.zookeeper:zookeeper@3.4.9.

Overview

io.netty:netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients.

Affected versions of this package are vulnerable to Information Exposure. It does not validate cookie name and value characters, allowing attackers to potentially bypass the httpOnly flag on sensitive cookies.

Remediation

Upgrade io.netty:netty to version 3.9.8.Final, 3.10.3.Final or higher.

References

high severity

Information Exposure

  • Vulnerable module: org.apache.hadoop:hadoop-hdfs
  • Introduced through: org.apache.spark:spark-core_2.11@2.4.7 and org.apache.spark:spark-streaming_2.11@2.4.7

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-hdfs@2.6.5
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-hdfs@2.6.5

Overview

http://hadoop.apache.org/ is the primary distributed storage used by Hadoop applications.

Affected versions of this package are vulnerable to Information Exposure. An attacker may retrive information about paths that they do not have permissions to see.

Remediation

Upgrade org.apache.hadoop:hadoop-hdfs to versions 2.7.4 or higher.

References

high severity

Authentication Bypass

  • Vulnerable module: org.apache.zookeeper:zookeeper
  • Introduced through: org.apache.zookeeper:zookeeper@3.4.6, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.zookeeper:zookeeper@3.4.6
    Remediation: Upgrade to org.apache.zookeeper:zookeeper@3.4.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.apache.hadoop:hadoop-auth@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.apache.hadoop:hadoop-auth@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6

Overview

org.apache.zookeeper:zookeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services.

Affected versions of this package are vulnerable to Authentication Bypass. No authentication/authorization is enforced when a server attempts to join a quorum, as a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.

Remediation

Upgrade org.apache.zookeeper:zookeeper to version 3.4.10, 3.5.4-beta or higher.

References

high severity

Denial of Service (DoS)

  • Vulnerable module: org.apache.zookeeper:zookeeper
  • Introduced through: org.apache.zookeeper:zookeeper@3.4.6, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.zookeeper:zookeeper@3.4.6
    Remediation: Upgrade to org.apache.zookeeper:zookeeper@3.4.10.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.apache.hadoop:hadoop-auth@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.apache.hadoop:hadoop-auth@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.zookeeper:zookeeper@3.4.6

Overview

org.apache.zookeeper:zookeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services.

Affected versions of this package are vulnerable to Denial of Service (DoS). Four letter zookeeper commands (such as wchp/wchc ) are not properly handled, which leads to the server unable to serve legitimate client requests.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade org.apache.zookeeper:zookeeper to version 3.4.10, 3.5.3-beta or higher.

References

high severity

XML External Entity (XXE) Injection

  • Vulnerable module: org.codehaus.jackson:jackson-mapper-asl
  • Introduced through: org.apache.avro:avro@1.8.2

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.avro:avro@1.8.2 org.codehaus.jackson:jackson-mapper-asl@1.9.13

Overview

org.codehaus.jackson:jackson-mapper-asl is a high-performance data binding package built on Jackson JSON processor.

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. Multiple classes including XmlMapper was found to be vulnerable to XXE, which might allow attackers to have unspecified impact via unknown vectors.

Details

XXE Injection is a type of attack against an application that parses XML input. XML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.

Attacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.

For example, below is a sample XML document, containing an XML element- username.

<?xml version="1.0" encoding="ISO-8859-1"?>
   <username>John</username>
</xml>

An external XML entity - xxe, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of /etc/passwd and display it to the user rendered by username.

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
   <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
   <username>&xxe;</username>
</xml>

Other XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.

Remediation

There is no fixed version for org.codehaus.jackson:jackson-mapper-asl.

For org.codehaus.jackson:jackson-all releases supporting jackson-mapper-asl. As a workaround, for 1.9.X release, the javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING setting can be enabled. For 2.x releases, the "javax.xml.stream.isSupportingExternalEntities setting can be set to FALSE.

References

high severity

XML Entity Expansion

  • Vulnerable module: org.glassfish.jersey.media:jersey-media-jaxb
  • Introduced through: org.glassfish.jersey.core:jersey-server@2.22.2, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.glassfish.jersey.core:jersey-server@2.22.2 org.glassfish.jersey.media:jersey-media-jaxb@2.22.2
    Remediation: Upgrade to org.glassfish.jersey.core:jersey-server@2.31.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.glassfish.jersey.core:jersey-server@2.22.2 org.glassfish.jersey.media:jersey-media-jaxb@2.22.2
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.glassfish.jersey.core:jersey-server@2.22.2 org.glassfish.jersey.media:jersey-media-jaxb@2.22.2

Overview

org.glassfish.jersey.media:jersey-media-jaxb is a REST framework that provides JAX-RS Reference Implementation and more.

Affected versions of this package are vulnerable to XML Entity Expansion. The SAXParserFactory provider is only disabling external entities, and does not protect against XML entity expansion.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade org.glassfish.jersey.media:jersey-media-jaxb to version 2.31 or higher.

References

high severity

Denial of Service (DoS)

  • Vulnerable module: xerces:xercesImpl
  • Introduced through: org.apache.spark:spark-core_2.11@2.4.7 and org.apache.spark:spark-streaming_2.11@2.4.7

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-hdfs@2.6.5 xerces:xercesImpl@2.9.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-hdfs@2.6.5 xerces:xercesImpl@2.9.1

Overview

xerces:xercesImpl is a that is used for high performance, fully compliant XML parsers in the Apache Xerces family.

Affected versions of this package are vulnerable to Denial of Service (DoS). Apache Xerces2 Java allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.

Remediation

Upgrade xerces:xercesImpl to version 2.12.0 or higher.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

References

high severity

Cryptographic Issues

  • Vulnerable module: org.apache.hadoop:hadoop-hdfs
  • Introduced through: org.apache.spark:spark-core_2.11@2.4.7 and org.apache.spark:spark-streaming_2.11@2.4.7

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-hdfs@2.6.5
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-hdfs@2.6.5

Overview

org.apache.hadoop:hadoop-hdfs is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models.

Affected versions of this package are vulnerable to Cryptographic Issues. It does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.

Remediation

Upgrade org.apache.hadoop:hadoop-hdfs to version 2.7.0 or higher.

References

high severity

Improper Input Validation

  • Vulnerable module: org.apache.hadoop:hadoop-hdfs
  • Introduced through: org.apache.spark:spark-core_2.11@2.4.7 and org.apache.spark:spark-streaming_2.11@2.4.7

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-hdfs@2.6.5
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-hdfs@2.6.5

Overview

org.apache.hadoop:hadoop-hdfs is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models.

HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0.

References

medium severity

HTTP Request Smuggling

  • Vulnerable module: io.netty:netty
  • Introduced through: io.netty:netty@3.6.2.Final and org.apache.zookeeper:zookeeper@3.4.6

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 io.netty:netty@3.6.2.Final
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.zookeeper:zookeeper@3.4.6 io.netty:netty@3.6.2.Final

Overview

io.netty:netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients.

Affected versions of this package are vulnerable to HTTP Request Smuggling. Netty mishandles whitespace before the colon in HTTP headers such as a Transfer-Encoding : chunked line. This can lead to HTTP request smuggling where an attacker can bypass security controls, gain unauthorized access to sensitive data, and directly compromise other application users.

Remediation

There is no fixed version for io.netty:netty.

References

medium severity

Denial of Service (DoS)

  • Vulnerable module: org.apache.commons:commons-compress
  • Introduced through: org.apache.avro:avro@1.8.2, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.avro:avro@1.8.2 org.apache.commons:commons-compress@1.8.1
    Remediation: Upgrade to org.apache.avro:avro@1.11.0.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.avro:avro@1.8.2 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.avro:avro@1.8.2 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1

Overview

org.apache.commons:commons-compress is an API for working with compression and archive formats.

Affected versions of this package are vulnerable to Denial of Service (DoS). When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out-of-memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade org.apache.commons:commons-compress to version 1.21 or higher.

References

medium severity

Denial of Service (DoS)

  • Vulnerable module: org.apache.commons:commons-compress
  • Introduced through: org.apache.avro:avro@1.8.2, org.apache.spark:spark-core_2.11@2.4.7 and others

Detailed paths

  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.avro:avro@1.8.2 org.apache.commons:commons-compress@1.8.1
    Remediation: Upgrade to org.apache.avro:avro@1.11.0.
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.avro:avro@1.8.2 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.avro:avro@1.8.2 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-yarn-server-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-streaming_2.11@2.4.7 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-core@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-app@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1
  • Introduced through: ging/fiware-cosmos-orion-spark-connector@ging/fiware-cosmos-orion-spark-connector#7aeeed240b8a8acbd309ce5e7abd4a548a5f2172 org.apache.spark:spark-core_2.11@2.4.7 org.apache.hadoop:hadoop-client@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-jobclient@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-shuffle@2.6.5 org.apache.hadoop:hadoop-mapreduce-client-common@2.6.5 org.apache.hadoop:hadoop-yarn-client@2.6.5 org.apache.hadoop:hadoop-yarn-common@2.6.5 org.apache.commons:commons-compress@1.8.1