Deserialization of Untrusted Data in jackson-databind - CVE-2020-9548

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU25832

Deserialization of Untrusted Data in jackson-databind - CVE-2020-9548

Published: March 9, 2020 / Updated: April 12, 2020


Vulnerability identifier: #VU25832
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber
CVE-ID: CVE-2020-9548
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability: Public exploit is available
Affected software:
jackson-databind
z/Transaction Processing Facility ( z/TPF)
Log Analysis
IBM Process Mining
IBM Cloud Application Performance Management (APM)
IBM Security Verify Governance
Cloudera Observability with IBM
Dell Support Assist Enterprise
Integration Designer
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
Storage Virtualize
IBM Sterling Order Management
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
JBoss Enterprise Application Platform
eap7-jettison (Red Hat package)
eap7-velocity (Red Hat package)
eap7-snakeyaml (Red Hat package)
eap7-jackson-databind (Red Hat package)
eap7-resteasy (Red Hat package)
eap7-apache-cxf (Red Hat package)
eap7-netty (Red Hat package)
eap7-wildfly (Red Hat package)
IBM Disconnected Log Collector
watsonx.data

Detailed vulnerability description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data between serialization gadgets and typing. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: This vulnerability is related to:

  • br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core)

How to mitigate CVE-2020-9548

Install updates from vendor's website.

Sources