CVE-2020-25649 - related to com.fasterxml.jackson.core:jackson-databind inspring-cloud-cloudfoundry-connector-2.0.7.RELEASE.jar

Hello,

At least one CVE (CVE-2020-25649) is brought up with com.fasterxml.jackson.core:jackson-databind version 2.10.0 included in spring-cloud-cloudfoundry-connector-2.0.7.RELEASE. The corrections were fixed in version 2.10.5.1 and later.

Here the log of a DependencyCheck execution

spring-cloud-cloudfoundry-connector-2.0.7.RELEASE.jar\META-INF/maven/com.fasterxml.jackson.core/jackson-databind/pom.xml (pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.0, cpe:2.3:a:fasterxml:jackson-databind:2.10.0:*:*:
*:*:*:*:*, cpe:2.3:a:fasterxml:jackson-modules-java8:2.10.0:*:*:*:*:*:*:*) : CVE-2020-25649

Could the version be updated in a quick upcoming fix? or is migrating to the newer Java CFEnv the only way to fix this?

Thank you,

Alex

[scottfrederick]

Migrating to Java CFEnv is definitely the recommendation. While Spring Cloud Connectors is in maintenance mode we will continue to address critical security issues, but this library is vulnerable to these kinds of Jackson issues and an update can’t always be quick. Java CFEnv doesn’t suffer from this problem.

I’ll research this CVE to see of Connectors is vulnerable and publish a release if necessary.

[scottfrederick]

Can I trust that the shaded code is only used in the jar it’s shaded for, or could it leak to other code?

Please see the analysis provided in the comment above.

The best way to mitigate this type of problem is to replace the usage of Spring Cloud Connectors with Java CFEnv, since the latter does not shade the Jackson dependencies.