Fix CVE–2020–9547

[debricked-staging]

CVE–2020–9547

Vulnerable dependency:     com.fasterxml.jackson.core:jackson-databind (Maven)    2.3.3

Vulnerability details

Description

Deserialization of Untrusted Data

The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

GitHub

jackson-databind mishandles the interaction between serialization gadgets and typing

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

NVD

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

CVSS details - 9.8

 

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity	High
Availability	High

References

    NVD - CVE-2020-9547
    jackson-databind mishandles the interaction between serialization gadgets and typing · CVE-2020-9547 · GitHub Advisory Database · GitHub
    Block two more gadget types (ibatis-sqlmap, anteros-core; CVE-2020-9547 / CVE-2020-9548) · Issue #2634 · FasterXML/jackson-databind · GitHub
    On Jackson CVEs: Don’t Panic — Here is what you need to know | by @cowtowncoder | Medium
    [SECURITY] [DLA 2135-1] jackson-databind security update
    MISC
    MLIST
    MLIST
    MLIST
    MLIST
    MISC
    MISC
    MLIST
    MISC
    MISC
    MLIST
    MISC
    MLIST
    MLIST
    Oracle Critical Patch Update Advisory - July 2020
    MLIST
    August 2020 FasterXML jackson-databind Vulnerabilities in NetApp Products | NetApp Product Security
    Oracle Critical Patch Update Advisory - October 2020
    Oracle Critical Patch Update Advisory - January 2021
    Block one more gadget type (shaded-hikari-config, CVE-2020-9546) · Issue #2631 · FasterXML/jackson-databind · GitHub
    Block one more gadget type (Anteros-DBCP, CVE-2020-24616) · Issue #2814 · FasterXML/jackson-databind · GitHub
    Issues · FasterXML/jackson-databind · GitHub
    Oracle Critical Patch Update Advisory - October 2021

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE