[Bug 1911502] New: CVE-2020-35728 jackson-databind: mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool
https://bugzilla.redhat.com/show_bug.cgi?id=1911502
Bug ID: 1911502 Summary: CVE-2020-35728 jackson-databind: mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDICon nectionPool Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: gsuckevi@redhat.com CC: aboyko@redhat.com, aileenc@redhat.com, akoufoud@redhat.com, alazarot@redhat.com, almorale@redhat.com, anstephe@redhat.com, aos-bugs@redhat.com, asoldano@redhat.com, atangrin@redhat.com, ataylor@redhat.com, avibelli@redhat.com, bbaranow@redhat.com, bbuckingham@redhat.com, bcourt@redhat.com, bgeorges@redhat.com, bibryam@redhat.com, bkearney@redhat.com, bmaxwell@redhat.com, bmontgom@redhat.com, brian.stansberry@redhat.com, btofel@redhat.com, btotty@redhat.com, cdewolf@redhat.com, chazlett@redhat.com, clement.escoffier@redhat.com, dandread@redhat.com, darran.lofthouse@redhat.com, dbecker@redhat.com, decathorpe@gmail.com, dkreling@redhat.com, dosoudil@redhat.com, drieden@redhat.com, eleandro@redhat.com, eparis@redhat.com, eric.wittmann@redhat.com, etirelli@redhat.com, ganandan@redhat.com, ggaughan@redhat.com, gmalinko@redhat.com, gsmet@redhat.com, gvarsami@redhat.com, hamadhan@redhat.com, hbraun@redhat.com, hhudgeon@redhat.com, ibek@redhat.com, iweiss@redhat.com, janstey@redhat.com, java-maint-sig@lists.fedoraproject.org, java-sig-commits@lists.fedoraproject.org, jawilson@redhat.com, jburrell@redhat.com, jcantril@redhat.com, jcoleman@redhat.com, jjoyce@redhat.com, jochrist@redhat.com, jokerman@redhat.com, jolee@redhat.com, jpallich@redhat.com, jperkins@redhat.com, jross@redhat.com, jschatte@redhat.com, jschluet@redhat.com, jstastny@redhat.com, jwon@redhat.com, kaycoth@redhat.com, kconner@redhat.com, krathod@redhat.com, kverlaen@redhat.com, kwills@redhat.com, ldimaggi@redhat.com, lef@fedoraproject.org, lgao@redhat.com, lhh@redhat.com, lpeer@redhat.com, lthon@redhat.com, lzap@redhat.com, mburns@redhat.com, mkolesni@redhat.com, mmccune@redhat.com, mnovotny@redhat.com, msochure@redhat.com, msvehla@redhat.com, mszynkie@redhat.com, nmoumoul@redhat.com, nstielau@redhat.com, nwallace@redhat.com, pantinor@redhat.com, pdrozd@redhat.com, pgallagh@redhat.com, pjindal@redhat.com, pmackay@redhat.com, probinso@redhat.com, puntogil@libero.it, rchan@redhat.com, rguimara@redhat.com, rhcs-maint@redhat.com, rjerrido@redhat.com, rrajasek@redhat.com, rruss@redhat.com, rstancel@redhat.com, rsvoboda@redhat.com, rsynek@redhat.com, rwagner@redhat.com, sbiarozk@redhat.com, sclewis@redhat.com, scohen@redhat.com, sdaley@redhat.com, sd-operator-metering@redhat.com, sdouglas@redhat.com, slinaber@redhat.com, smaestri@redhat.com, sokeeffe@redhat.com, sponnaga@redhat.com, sthorger@redhat.com, swoodman@redhat.com, tbrisker@redhat.com, tcunning@redhat.com, tkirby@redhat.com, tom.jenkinson@redhat.com, vhalbert@redhat.com Target Milestone: --- Classification: Other
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).
Reference: https://github.com/FasterXML/jackson-databind/issues/2999
https://bugzilla.redhat.com/show_bug.cgi?id=1911502
--- Comment #2 from Paramvir jindal pjindal@redhat.com --- External References:
https://github.com/FasterXML/jackson-databind/issues/2999 https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-...
https://bugzilla.redhat.com/show_bug.cgi?id=1911502
Paramvir jindal pjindal@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |jackson-databind 2.9.10.8
https://bugzilla.redhat.com/show_bug.cgi?id=1911502
Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1911584, 1911586, 1911588, | |1911587, 1911585
https://bugzilla.redhat.com/show_bug.cgi?id=1911502
--- Comment #9 from Paramvir jindal pjindal@redhat.com --- Mitigation:
The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` * avoid com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool in the classpath
https://bugzilla.redhat.com/show_bug.cgi?id=1911502
--- Comment #10 from Paramvir jindal pjindal@redhat.com --- Statement:
The following Red Hat Products ship jackson-databind version 2.10.0 or later which is not considered affected by this CVE (see https://medium.com/@cowtowncoder/jackson-2-10-safe-default-typing-2d018f0ce2...) * JBoss Data Grid 7 * JBoss Data Grid 8 * Enterprise Application Platform 7 * Red Hat Decision Manager 7 * Red Hat Process Automation Manager 7 * Red Hat Single Sign-On (RH-SSO) 7 * Red Hat JBoss Fuse 7 * Red Hat JBoss A-MQ
https://bugzilla.redhat.com/show_bug.cgi?id=1911502
--- Comment #11 from Paramvir jindal pjindal@redhat.com --- This vulnerability is out of security support scope for the following products: * Red Hat JBoss BRMS 6 * Red Hat JBoss BPMS 6 * Red Hat JBoss Data Virtualization 6 * Red Hat JBoss Fuse Service Works 6
Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
https://bugzilla.redhat.com/show_bug.cgi?id=1911502
--- Doc Text *updated* by Paramvir jindal pjindal@redhat.com --- A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.8. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
https://bugzilla.redhat.com/show_bug.cgi?id=1911502
--- Comment #12 from Huzaifa S. Sidhpurwala huzaifas@redhat.com --- Statement:
The following Red Hat Products ship jackson-databind version 2.10.0 or later which is not considered affected by this CVE (see https://medium.com/@cowtowncoder/jackson-2-10-safe-default-typing-2d018f0ce2...) * JBoss Data Grid 7 * JBoss Data Grid 8 * Enterprise Application Platform 7 * Red Hat Decision Manager 7 * Red Hat Process Automation Manager 7 * Red Hat Single Sign-On (RH-SSO) 7 * Red Hat JBoss Fuse 7 * Red Hat JBoss A-MQ * Red Hat Enterprise Linux 8
https://bugzilla.redhat.com/show_bug.cgi?id=1911502
--- Comment #13 from Borja Tarraso btarraso@redhat.com --- Statement:
The following Red Hat Products ship jackson-databind version 2.10.0 or later which is not considered affected by this CVE (see https://medium.com/@cowtowncoder/jackson-2-10-safe-default-typing-2d018f0ce2...) * JBoss Data Grid 7 * JBoss Data Grid 8 * Enterprise Application Platform 7 * Red Hat Decision Manager 7 * Red Hat Process Automation Manager 7 * Red Hat Single Sign-On (RH-SSO) 7 * Red Hat JBoss Fuse 7 * Red Hat JBoss A-MQ * Red Hat Enterprise Linux 8 * Red Hat Satellite 6.6 * Red Hat Satellite 6.7 * Red Hat Satellite 6.8
https://bugzilla.redhat.com/show_bug.cgi?id=1911502
--- Comment #16 from Nick Tait ntait@redhat.com --- Statement:
Red Hat OpenStack Platform does ship the vulnerable component, but does not enable the unsafe conditions needed to exploit, lowering the vulnerability impact.
Red Hat OpenStack Platform 13 ships OpenDaylight, which contains the vulnerable jackson-databind, but does not expose jackson-databind in a way that would make it exploitable. As such, Red Hat will not be providing a fix for OpenDaylight at this time.
https://bugzilla.redhat.com/show_bug.cgi?id=1911502
--- Comment #17 from Nick Tait ntait@redhat.com --- Statement:
The following Red Hat Products ship jackson-databind version 2.10.0 or later which is not considered affected by this CVE (see https://medium.com/@cowtowncoder/jackson-2-10-safe-default-typing-2d018f0ce2...) * JBoss Data Grid 7 * JBoss Data Grid 8 * Enterprise Application Platform 7 * Red Hat Decision Manager 7 * Red Hat Process Automation Manager 7 * Red Hat Single Sign-On (RH-SSO) 7 * Red Hat JBoss Fuse 7 * Red Hat JBoss A-MQ * Red Hat Enterprise Linux 8 * Red Hat Satellite 6.6 * Red Hat Satellite 6.7 * Red Hat Satellite 6.8
Red Hat OpenStack Platform does ship the vulnerable component, but does not enable the unsafe conditions needed to exploit, lowering the vulnerability impact.
Red Hat OpenStack Platform 13 ships OpenDaylight, which contains the vulnerable jackson-databind, but does not expose jackson-databind in a way that would make it exploitable. As such, Red Hat will not be providing a fix for OpenDaylight at this time.
https://bugzilla.redhat.com/show_bug.cgi?id=1911502
Nick Tait ntait@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1911685, 1911688, 1911684, | |1911683, 1911686, 1911687
https://bugzilla.redhat.com/show_bug.cgi?id=1911502
--- Comment #19 from Todd Cullum tcullum@redhat.com --- Statement:
The following Red Hat Products ship jackson-databind version 2.10.0 or later which is not considered affected by this CVE (see https://medium.com/@cowtowncoder/jackson-2-10-safe-default-typing-2d018f0ce2...) * JBoss Data Grid 7 * JBoss Data Grid 8 * Enterprise Application Platform 7 * Red Hat Decision Manager 7 * Red Hat Process Automation Manager 7 * Red Hat Single Sign-On (RH-SSO) 7 * Red Hat JBoss Fuse 7 * Red Hat JBoss A-MQ * Red Hat Enterprise Linux 8 * Red Hat Satellite 6.6 * Red Hat Satellite 6.7 * Red Hat Satellite 6.8 * Red Hat CodeReady Studio 12.17.0
Red Hat OpenStack Platform does ship the vulnerable component, but does not enable the unsafe conditions needed to exploit, lowering the vulnerability impact.
Red Hat OpenStack Platform 13 ships OpenDaylight, which contains the vulnerable jackson-databind, but does not expose jackson-databind in a way that would make it exploitable. As such, Red Hat will not be providing a fix for OpenDaylight at this time.
https://bugzilla.redhat.com/show_bug.cgi?id=1911502
--- Comment #20 from Todd Cullum tcullum@redhat.com --- Statement:
The following Red Hat Products ship jackson-databind version 2.10.0 or later which is not considered affected by this CVE (see https://medium.com/@cowtowncoder/jackson-2-10-safe-default-typing-2d018f0ce2...) * JBoss Data Grid 7 * JBoss Data Grid 8 * Enterprise Application Platform 7 * Red Hat Decision Manager 7 * Red Hat Process Automation Manager 7 * Red Hat Single Sign-On (RH-SSO) 7 * Red Hat JBoss Fuse 7 * Red Hat JBoss A-MQ * Red Hat Enterprise Linux 8 * Red Hat Satellite 6.6 * Red Hat Satellite 6.7 * Red Hat Satellite 6.8 * Red Hat CodeReady Studio 12
Red Hat OpenStack Platform does ship the vulnerable component, but does not enable the unsafe conditions needed to exploit, lowering the vulnerability impact.
Red Hat OpenStack Platform 13 ships OpenDaylight, which contains the vulnerable jackson-databind, but does not expose jackson-databind in a way that would make it exploitable. As such, Red Hat will not be providing a fix for OpenDaylight at this time.
https://bugzilla.redhat.com/show_bug.cgi?id=1911502
Hardik Vyas hvyas@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1882681
https://bugzilla.redhat.com/show_bug.cgi?id=1911502
Hardik Vyas hvyas@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1882679
https://bugzilla.redhat.com/show_bug.cgi?id=1911502
Hardik Vyas hvyas@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1882683
https://bugzilla.redhat.com/show_bug.cgi?id=1911502
Hardik Vyas hvyas@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1882680
https://bugzilla.redhat.com/show_bug.cgi?id=1911502
--- Doc Text *updated* by Eric Christensen sparks@redhat.com --- A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
https://bugzilla.redhat.com/show_bug.cgi?id=1911502 Bug 1911502 depends on bug 1911503, which changed state.
Bug 1911503 Summary: CVE-2020-35728 jackson-databind: mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1911503
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |NOTABUG
https://bugzilla.redhat.com/show_bug.cgi?id=1911502
--- Comment #23 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 4.6
Via RHSA-2021:1230 https://access.redhat.com/errata/RHSA-2021:1230
https://bugzilla.redhat.com/show_bug.cgi?id=1911502
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2021-04-27 10:47:08
--- Comment #24 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2020-35728
java-sig-commits@lists.fedoraproject.org
-
bugzilla＠redhat.com