Deserialization of Untrusted Data in jackson-databind - CVE-2020-9546
Published: March 9, 2020 / Updated: April 12, 2020
Vulnerability identifier: #VU25830
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-9546
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data between serialization gadgets and typing. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: This vulnerability is related to:
- org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config)
Affected software
jackson-databind
z/Transaction Processing Facility ( z/TPF)
Log Analysis
IBM Process Mining
Oracle Financial Services Institutional Performance Analytics
Oracle Financial Services Price Creation and Discovery
Oracle Global Lifecycle Management OPatch
Enterprise Manager Base Platform
IBM Cloud Application Performance Management (APM)
IBM Security Verify Governance
Oracle Banking Platform
Cloudera Observability with IBM
Dell Support Assist Enterprise
Oracle Communications Network Charging and Control
Oracle Financial Services Analytical Applications Infrastructure
Oracle Retail Service Backbone
Integration Designer
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
Storage Virtualize
IBM Sterling Order Management
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
Oracle Communications Evolved Communications Application Server
JBoss Enterprise Application Platform
Oracle WebLogic Server
Oracle Communications Contacts Server
Oracle Communications Instant Messaging Server
Oracle Financial Services Retail Customer Analytics
Oracle Retail Sales Audit
Oracle Insurance Policy Administration
Oracle Retail Merchandising System
Primavera Unifier
IBM Disconnected Log Collector
JD Edwards EnterpriseOne Tools
eap7-jettison (Red Hat package)
eap7-velocity (Red Hat package)
eap7-snakeyaml (Red Hat package)
eap7-jackson-databind (Red Hat package)
eap7-resteasy (Red Hat package)
eap7-apache-cxf (Red Hat package)
eap7-netty (Red Hat package)
eap7-wildfly (Red Hat package)
JD Edwards EnterpriseOne Orchestrator
z/Transaction Processing Facility ( z/TPF)
Log Analysis
IBM Process Mining
Oracle Financial Services Institutional Performance Analytics
Oracle Financial Services Price Creation and Discovery
Oracle Global Lifecycle Management OPatch
Enterprise Manager Base Platform
IBM Cloud Application Performance Management (APM)
IBM Security Verify Governance
Oracle Banking Platform
Cloudera Observability with IBM
Dell Support Assist Enterprise
Oracle Communications Network Charging and Control
Oracle Financial Services Analytical Applications Infrastructure
Oracle Retail Service Backbone
Integration Designer
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
Storage Virtualize
IBM Sterling Order Management
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
Oracle Communications Evolved Communications Application Server
JBoss Enterprise Application Platform
Oracle WebLogic Server
Oracle Communications Contacts Server
Oracle Communications Instant Messaging Server
Oracle Financial Services Retail Customer Analytics
Oracle Retail Sales Audit
Oracle Insurance Policy Administration
Oracle Retail Merchandising System
Primavera Unifier
IBM Disconnected Log Collector
JD Edwards EnterpriseOne Tools
eap7-jettison (Red Hat package)
eap7-velocity (Red Hat package)
eap7-snakeyaml (Red Hat package)
eap7-jackson-databind (Red Hat package)
eap7-resteasy (Red Hat package)
eap7-apache-cxf (Red Hat package)
eap7-netty (Red Hat package)
eap7-wildfly (Red Hat package)
JD Edwards EnterpriseOne Orchestrator
How to mitigate CVE-2020-9546
Install updates from vendor's website.
jackson-databind - addressed in versions 2.7.9.7, 2.8.11.6, 2.9.10.4
Log Analysis - addressed in versions 1.3.7.2 IF001, 1.3.7.2 IF002, 1.3.7.2 IF003
IBM Process Mining - update to 1.12.0.4
Cloudera Observability with IBM - update to 3.6.2
Dell Support Assist Enterprise - update to 4.00.06.00
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.8.0
JBoss Enterprise Application Platform - update to 7.1.9
Oracle Global Lifecycle Management OPatch - update to 12.2.0.1.20
eap7-jettison (Red Hat package) - update to 1.3.8-2.redhat_00002.1.ep7.el7
eap7-velocity (Red Hat package) - update to 1.7.0-3.redhat_00006.1.ep7.el7
IBM Disconnected Log Collector - update to 1.8.3
eap7-snakeyaml (Red Hat package) - update to 1.33.0-1.SP1_redhat_00001.1.ep7.el7
eap7-jackson-databind (Red Hat package) - update to 2.8.11.6-2.SP1_redhat_00002.1.ep7.el7
eap7-resteasy (Red Hat package) - update to 3.0.27-1.Final_redhat_00001.1.ep7.el7
eap7-apache-cxf (Red Hat package) - update to 3.1.16-4.redhat_00003.1.ep7.el7
eap7-netty (Red Hat package) - update to 4.1.63-1.Final_redhat_00002.1.ep7.el7
DB2 Warehouse on Cloud Pak for Data - update to 4.8.5
DB2 on Cloud Pak for Data - update to 4.8.5
eap7-wildfly (Red Hat package) - update to 7.1.9-2.GA_redhat_00002.1.ep7.el7
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
Storage Virtualize - addressed in versions 8.6.3.0, 8.7.0.0
JD Edwards EnterpriseOne Orchestrator - update to 9.2.4.2
JD Edwards EnterpriseOne Tools - update to 9.2.4.2
IBM Security Verify Governance - update to 10.0.1.0.4
IBM Sterling Order Management - update to 10.0.2309.0
Log Analysis - addressed in versions 1.3.7.2 IF001, 1.3.7.2 IF002, 1.3.7.2 IF003
IBM Process Mining - update to 1.12.0.4
Cloudera Observability with IBM - update to 3.6.2
Dell Support Assist Enterprise - update to 4.00.06.00
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.8.0
JBoss Enterprise Application Platform - update to 7.1.9
Oracle Global Lifecycle Management OPatch - update to 12.2.0.1.20
eap7-jettison (Red Hat package) - update to 1.3.8-2.redhat_00002.1.ep7.el7
eap7-velocity (Red Hat package) - update to 1.7.0-3.redhat_00006.1.ep7.el7
IBM Disconnected Log Collector - update to 1.8.3
eap7-snakeyaml (Red Hat package) - update to 1.33.0-1.SP1_redhat_00001.1.ep7.el7
eap7-jackson-databind (Red Hat package) - update to 2.8.11.6-2.SP1_redhat_00002.1.ep7.el7
eap7-resteasy (Red Hat package) - update to 3.0.27-1.Final_redhat_00001.1.ep7.el7
eap7-apache-cxf (Red Hat package) - update to 3.1.16-4.redhat_00003.1.ep7.el7
eap7-netty (Red Hat package) - update to 4.1.63-1.Final_redhat_00002.1.ep7.el7
DB2 Warehouse on Cloud Pak for Data - update to 4.8.5
DB2 on Cloud Pak for Data - update to 4.8.5
eap7-wildfly (Red Hat package) - update to 7.1.9-2.GA_redhat_00002.1.ep7.el7
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
Storage Virtualize - addressed in versions 8.6.3.0, 8.7.0.0
JD Edwards EnterpriseOne Orchestrator - update to 9.2.4.2
JD Edwards EnterpriseOne Tools - update to 9.2.4.2
IBM Security Verify Governance - update to 10.0.1.0.4
IBM Sterling Order Management - update to 10.0.2309.0
External References
- https://github.com/FasterXML/jackson-databind/issues/2631
- https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r893a0104e50c1c2559eb9a5812add28ae8c3e5f43712947a9847ec18@%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1@%3Cdev.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6@%3Cissues.zookeeper.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html
- https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
Related Security Bulletins
- Multiple vulnerabilities in FasterXML jackson-databind
- Deserialization of Untrusted Data in Oracle Global Lifecycle Management OPatch
- Multiple vulnerabilities in Oracle Communications Network Charging and Control
- Multiple vulnerabilities in Oracle Communications Instant Messaging Server
- Deserialization of Untrusted Data in Oracle Communications Evolved Communications Application Server
- Multiple vulnerabilities in Oracle Communications Contacts Server
- Multiple vulnerabilities in Enterprise Manager Base Platform
- Multiple vulnerabilities in Primavera Unifier
- Multiple vulnerabilities in Oracle Banking Platform
- Multiple vulnerabilities in Oracle WebLogic Server
- Multiple vulnerabilities in JD Edwards EnterpriseOne Tools
- Deserialization of Untrusted Data in JD Edwards EnterpriseOne Orchestrator
- Multiple vulnerabilities in Red Hat Process Automation Manager
- Multiple vulnerabilities in Oracle Financial Services Retail Customer Analytics
- Multiple vulnerabilities in Oracle Financial Services Price Creation and Discovery
- Multiple vulnerabilities in Oracle Financial Services Institutional Performance Analytics
- Multiple vulnerabilities in Oracle Financial Services Analytical Applications Infrastructure
- Multiple vulnerabilities in Oracle Insurance Policy Administration J2EE
- Multiple vulnerabilities in Oracle Retail Service Backbone
- Deserialization of Untrusted Data in Oracle Retail Sales Audit
- Deserialization of Untrusted Data in Oracle Retail Merchandising System
- Multiple vulnerabilities in IBM Process Mining
- Multiple vulnerabilities in z/Transaction Processing Facility
- IBM Log Analysis update for FasterXML jackson-databind
- Multiple vulnerabilities in IBM Security Verify Governance
- Multiple vulnerabilities in IBM Application Performance Management products
- Multiple vulnerabilities in IBM Sterling Order Management
- Multiple vulnerabilities in IBM Disconnected Log Collector
- Multiple vulnerabilities in IBM Integration Designer
- Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data
- Multiple vulnerabilities in Dell Support Assist Enterprise
- Multiple vulnerabilities in IBM Storage Virtualize
- Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
- Multiple vulnerabilities in Cloudera Observability on Premises with IBM