PT-2020-5489 · Fasterxml+3 · Jackson-Databind+3
Published
2020-01-31
·
Updated
2025-01-28
·
CVE-2020-11112
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
FasterXML jackson-databind versions 2.x before 2.9.10.4
Description
The issue is related to the interaction between serialization gadgets and typing, specifically with the org.apache.commons.proxy.provider.remoting.RmiProvider component. This can lead to the exploitation of the vulnerability, potentially allowing a remote attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability is associated with the mishandling of data deserialization.
Recommendations
For FasterXML jackson-databind versions 2.x before 2.9.10.4, update to version 2.9.10.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the org.apache.commons.proxy.provider.remoting.RmiProvider component until a patch is applied.
Exploit
Fix
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Apache Commons
Ubuntu
Jackson-Databind