Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Block one more gadget type (logback, CVE-2019-12384)

See original GitHub issue

A new gadget type (see https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062) was reported, and CVE id allocated was CVE-2019-12384. CVE description is available at: https://nvd.nist.gov/vuln/detail/CVE-2019-12384 for full details, but the specific variation (in addition to needing “default typing”, attacker being able to craft specific json message) is that:

If service has jar logback-classic in its classpath

vulnerability applies.

Fixed in:

2.9.10
2.8.11.4
2.7.9.6
2.6.7.3

Issue Analytics

State:
Created 4 years ago
Comments:10 (6 by maintainers)

Top GitHub Comments

3reactions

cowtowncodercommented, Jul 3, 2019

Release 2.9.9.1 in-progress.

1reaction

jebeaudetcommented, Jul 4, 2019

@cowtowncoder Are you planning on releasing a 2.9.9.1 for the jackson-bom artifact containing this jackson-databind release? Thanks

Top Results From Across the Web

CVE-2019-12384 jackson-databind - Red Hat Bugzilla

9. The vulnerability would permit polymorphic deserialization of malicious objects using the logback-core gadget when used in conjunction with polymorphic type ...

Deserialization of Untrusted Data in com.fasterxml.jackson ...

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized. 2. Polymorphic type handling for ...

CVE-2019-12384 Detail - NVD

This vulnerability has been modified since it was last analyzed by the ... to block the logback-core class from polymorphic deserialization.

Security Bulletin: Multiple vulnerabilities in Data-Binding ... - IBM

By sending specially-crafted input, an attacker could exploit this ... to block the logback-core class from polymorphic deserialization.

Jackson gadgets - Anatomy of a vulnerability - Doyensec's Blog

Jackson CVE-2019-12384: anatomy of a vulnerability class ... a version of Jackson that does not (yet) block the specific “gadget” class.