CVE-2021-20190: SSRF
A flaw was found in jackson-databind before 2.9.10.7 and 2.6.7.5. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
jackson-databind 2.9.10.6 is affected by: SSRF,Deserialization vulnerability. The impact is: SSRF (remote). The component is: Use jackson-databind version 2.9.10.6 and create an ObjectMapper object mapper. When using mapper.enableDefaultTyping(), call mapper.readValue(payload="[\"javax.swing.JTextPane\",{\"page\":\"remoteaddr\"}], Object.class) can cause ssrf.
References:
https://github.com/FasterXML/jackson-databind/issues/2854
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.6.7.5 - Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.7 - Upgrade
Upgrade
redhat/jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.7 - Upgrade
Upgrade
jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10.7 - Upgrade
Upgrade
jackson-databindto a version that resolves this vulnerability.Fixed in 2.6.7.5 - Configuration
Avoid calling mapper.enableDefaultTyping(); using it can allow deserialization gadget/type interactions (e.g., mapper.readValue(...) with a javax.swing.JTextPane type) leading to SSRF.
jackson-databind ObjectMapper enableDefaultTyping() = do not enable - Configuration
Do not use @JsonTypeInfo(using=...) with id.CLASS or id.MINIMAL_CLASS, since these typing modes combined with deserialization gadgets can enable the described exploit conditions.
jackson-databind polymorphic typing @JsonTypeInfo using = avoid id.CLASS and id.MINIMAL_CLASS - Compensating control
Avoid putting javax.swing on the classpath to reduce the available serialization/deserialization gadgets involved in the demonstrated SSRF scenario (e.g., javax.swing.JTextPane).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-20190?
CVE-2021-20190 is a vulnerability in jackson-databind that mishandles the interaction between serialization gadgets and typing, posing a threat to data confidentiality, integrity, and system availability.
How severe is CVE-2021-20190?
CVE-2021-20190 has a severity score of 8.1 (high).
Which software is affected by CVE-2021-20190?
CVE-2021-20190 affects jackson-databind versions before 2.9.10.7 and 2.6.7.5.
How can I fix CVE-2021-20190?
To fix CVE-2021-20190, update jackson-databind to version 2.9.10.7 or higher.
Where can I find more information about CVE-2021-20190?
You can find more information about CVE-2021-20190 at the following references: [CVE-2021-20190](https://www.cve.org/CVERecord?id=CVE-2021-20190), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-20190), [GitHub Advisory](https://github.com/advisories/GHSA-5949-rw7g-wx7w), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1916633), [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2021:1515)