Deserialization of Untrusted Data in jackson-databind - CVE-2020-9547

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU25831

Deserialization of Untrusted Data in jackson-databind - CVE-2020-9547

Published: March 9, 2020 / Updated: April 12, 2020


Vulnerability identifier: #VU25831
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-9547
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data between serialization gadgets and typing. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: This vulnerability is related to:

  • com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap)

Affected software

jackson-databind
z/Transaction Processing Facility ( z/TPF)
Log Analysis
IBM Process Mining
IBM Cloud Application Performance Management (APM)
IBM Security Verify Governance
Cloudera Observability with IBM
Dell Support Assist Enterprise
Integration Designer
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
Storage Virtualize
IBM Sterling Order Management
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
JBoss Enterprise Application Platform
eap7-jettison (Red Hat package)
eap7-velocity (Red Hat package)
eap7-snakeyaml (Red Hat package)
eap7-jackson-databind (Red Hat package)
eap7-resteasy (Red Hat package)
eap7-apache-cxf (Red Hat package)
eap7-netty (Red Hat package)
eap7-wildfly (Red Hat package)
IBM Disconnected Log Collector
watsonx.data

How to mitigate CVE-2020-9547

Install updates from vendor's website.

jackson-databind - addressed in versions 2.7.9.7, 2.8.11.6, 2.9.10.4
Log Analysis - addressed in versions 1.3.7.2 IF001, 1.3.7.2 IF002, 1.3.7.2 IF003
IBM Process Mining - update to 1.12.0.4
Cloudera Observability with IBM - update to 3.6.2
Dell Support Assist Enterprise - update to 4.00.06.00
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.8.0
JBoss Enterprise Application Platform - update to 7.1.9
eap7-jettison (Red Hat package) - update to 1.3.8-2.redhat_00002.1.ep7.el7
eap7-velocity (Red Hat package) - update to 1.7.0-3.redhat_00006.1.ep7.el7
IBM Disconnected Log Collector - update to 1.8.3
eap7-snakeyaml (Red Hat package) - update to 1.33.0-1.SP1_redhat_00001.1.ep7.el7
watsonx.data - update to 2.0.2
eap7-jackson-databind (Red Hat package) - update to 2.8.11.6-2.SP1_redhat_00002.1.ep7.el7
eap7-resteasy (Red Hat package) - update to 3.0.27-1.Final_redhat_00001.1.ep7.el7
eap7-apache-cxf (Red Hat package) - update to 3.1.16-4.redhat_00003.1.ep7.el7
eap7-netty (Red Hat package) - update to 4.1.63-1.Final_redhat_00002.1.ep7.el7
DB2 Warehouse on Cloud Pak for Data - update to 4.8.5
DB2 on Cloud Pak for Data - update to 4.8.5
eap7-wildfly (Red Hat package) - update to 7.1.9-2.GA_redhat_00002.1.ep7.el7
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
Storage Virtualize - addressed in versions 8.6.3.0, 8.7.0.0
IBM Security Verify Governance - update to 10.0.1.0.4
IBM Sterling Order Management - update to 10.0.2309.0

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins