Skip to content

Polymorphic deserialization of malicious object in jackson-databind

High severity GitHub Reviewed Published May 15, 2020 to the GitHub Advisory Database • Updated Feb 1, 2023

Package

maven com.fasterxml.jackson.core:jackson-databind (Maven)

Affected versions

>= 2.9.0, < 2.9.10

Patched versions

2.9.10

Description

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping() or when @JsonTypeInfo is using Id.CLASS or Id.MINIMAL_CLASS or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.

References

Published by the National Vulnerability Database Mar 2, 2020
Reviewed Apr 22, 2020
Published to the GitHub Advisory Database May 15, 2020
Last updated Feb 1, 2023

Severity

High

EPSS score

2.479%
(90th percentile)

Weaknesses

CVE ID

CVE-2019-14893

GHSA ID

GHSA-qmqc-x3r4-6v39

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.