[PPP-5541] - Vulnerable Component: jackson-databind within htrace-core-3.1.0-incubating.jar #1548
Conversation
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
…e-3.1.0-incubating.jar
|
Analysis Details0 Issues
Coverage and Duplications
Project ID: org.pentaho:pentaho-hadoop-shims |
|
📦 Vulnerable Dependencies✍️ Summary
Note:Frogbot also supports Contextual Analysis, Secret Detection, IaC and SAST Vulnerabilities Scanning. This features are included as part of the JFrog Advanced Security package, which isn't enabled on your system. |
🔬 Research Details[ CVE-2019-20444 ] io.netty:netty 3.10.6.FinalDescription: [ CVE-2019-20445 ] io.netty:netty 3.10.6.FinalDescription: [ CVE-2022-39135 ] org.apache.calcite:calcite-core 1.19.0.7.1.9.0-387Description: [ CVE-2022-26612 ] org.apache.hadoop:hadoop-common 2.10.2Description: [ XRAY-138169 ] org.apache.hadoop:hadoop-yarn-server-resourcemanager 3.1.1.7.1.9.0-387Description: [ CVE-2019-14892 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, the Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2019-14893 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the [apache-xalan]( https://github.com/apache /xalan-j) gadget, a JNDI controller called Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2020-9547 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the Exploitation requires:
Remediation: Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( Deployment mitigationsRemove [ CVE-2020-9548 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2020-9546 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2020-8840 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2019-20330 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the net.sf.ehcache the attacker can call Exploitation requires:
Remediation: Development mitigationsAvoid enabling default typing ( Deployment mitigationsRemove Development mitigationsAvoid using [ CVE-2019-17531 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the apache-log4j-extra gadget, an attacker can create an arbitrary JNDI connection by invoking When this library is included, an attacker can build a working exploit, and even automate this process by using ysoserial, a tool that finds gadgets and create payloads for vulnerable java deserializers. Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2019-17267 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2019-16942 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the commons-dbcp gadget, an attacker can create an arbitrary JDBC connection by invoking When this library is included, an attacker can build a working exploit, and even automate this process by using ysoserial, a tool that finds gadgets and create payloads for vulnerable java deserializers. Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2019-16943 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the p6spy gadget, an attacker can create an arbitrary JDBC connection by invoking the When this library is included, an attacker can build a working exploit, and even automate this process by using ysoserial, a tool that finds gadgets and create payloads for vulnerable java deserializers. Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2019-14540 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2019-16335 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2019-14379 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, the Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2018-14718 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, the following classes were found to be able to cause remote code execution when used as Java gadgets - Exploitation requires:
Remediation: Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2018-14719 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, the following classes were found to be able to cause remote code execution when used as Java gadgets - Exploitation requires:
Remediation: Development mitigationsAvoid enabling default typing ( Development mitigationsAvoid using |
🔬 Research Details[ CVE-2018-14720 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, the following classes were found to be able to cause data leakage when used as Java gadgets - Exploitation requires:
Remediation: Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2018-14721 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, the blocked gadget is Exploitation requires:
Remediation: Development mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2018-19360 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, the blocked gadget is Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2018-19361 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, the blocked gadget is Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2018-19362 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, the blocked gadget is Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2018-7489 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, the following classes were found to be able to cause remote code execution when used as Java gadgets - Exploitation requires:
Remediation: Development mitigationsAvoid enabling default typing ( Development mitigationsAvoid using [ CVE-2017-15095 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, the following classes were found to be able to cause remote code execution when used as Java gadgets - Exploitation requires:
Remediation: Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2017-17485 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, the following classes were found to be able to cause remote code execution when used as Java gadgets:
Exploitation requires:
Remediation: Development mitigationsAvoid enabling default typing ( Development mitigationsAvoid using [ CVE-2017-7525 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, the following classes were found to be able to cause remote code execution when used as Java gadgets - Exploitation requires:
Remediation: Development mitigationsAvoid enabling default typing ( Development mitigationsAvoid using [ CVE-2019-10172 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description: [ CVE-2024-23945 ] org.apache.hive:hive-service 3.1.3000.7.1.9.0-387Description: The vulnerable CookieSigner logic was introduced in Apache Hive by HIVE-9710 (1.2.0) and in Apache Spark by SPARK-14987 (2.0.0). The affected components are the following:
[ CVE-2019-10202 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description: [ CVE-2020-11619 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the spring-aop gadget, an attacker can manipulate inner variables in When this library is included, an attacker can build a working exploit, and even automate this process by using ysoserial, a tool that finds gadgets and create payloads for vulnerable java deserializers. Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2020-11620 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the commons-jelly gadget, an attacker can setup a Jelly script and then execute it by invoking When this library is included, an attacker can build a working exploit, and even automate this process by using ysoserial, a tool that finds gadgets and create payloads for vulnerable java deserializers. Exploitation requires:
Remediation: Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( Deployment mitigationsRemove [ CVE-2020-10673 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the caucho gadget, an attacker can set Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2019-14439 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2019-12086 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, because of missing Exploitation requires:
Remediation: Development mitigationsAvoid using Deployment mitigationsRemove Development mitigationsAvoid enabling default typing ( [ CVE-2018-5968 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, the following classes were found to be able to cause remote code execution when used as Java gadgets - Exploitation requires:
Remediation: Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2022-46751 ] org.apache.ivy:ivy 2.5.1Description: Ivy files are XML files, usually called
When Ivy parses XML files - either its own configuration, Ivy files or Apache Maven POMs, it will allow downloading external document type definitions and expand any entity references contained therein when used, and thus leading to an Attacker can trigger the exploit by specifying use of an external entity in one of the mentioned XML files (given he finds a way to edit them). Such an example of external entity will be defining the XML The vulnerability could also be triggered by a supply chain attack, meaning that the attacker can exploit the vulnerability by uploading his malicious repository with an exploit to a non-malicious repository to which he has access. Example of malicious payload an attacker can add to an xml file: [ CVE-2021-37136 ] io.netty:netty 3.10.6.FinalDescription: A vulnerability was found in netty's Bzip2 decoder - when using the netty library and accepting arbitrary data streams to decode, netty does not limit the stream in any way. Example code that can trigger the issue - public static void main(String[] args) throws Exception {
Bzip2Decoder decoder = new Bzip2Decoder(); // Create the decompressor
final ByteBufAllocator allocator = new PooledByteBufAllocator(false);
FileInputStream file = new FileInputStream("C:\\temp\\100GB.bz2"); // External input
int inputChunks = 64 * 1024;
ByteBuf buf = allocator.heapBuffer(inputChunks);
ChannelHandlerContext ctx = new StubChannelHandlerContext(allocator);
while (buf.writeBytes(file, buf.writableBytes()) >= 0) {
System.out.println("Input: " + buf.capacity());
decoder.channelRead(ctx, buf); // BUG, No internal resource release!
buf = allocator.heapBuffer(inputChunks);
decoder.channelReadComplete(ctx);
}[ CVE-2021-37137 ] io.netty:netty 3.10.6.FinalDescription: A vulnerability was found in netty's Snappy decoder - when using the netty library and accepting arbitrary data streams to decode, netty does not limit the stream in any way. Example code that can trigger the issue - public static void main(String[] args) throws Exception {
SnappyFrameDecoder decoder = new SnappyFrameDecoder(); // Create the decompressor
final ByteBufAllocator allocator = new PooledByteBufAllocator(false);
FileInputStream file = new FileInputStream("C:\\temp\\100GB.snappy"); // External input
int inputChunks = 64 * 1024;
ByteBuf buf = allocator.heapBuffer(inputChunks);
ChannelHandlerContext ctx = new StubChannelHandlerContext(allocator);
while (buf.writeBytes(file, buf.writableBytes()) >= 0) {
System.out.println("Input: " + buf.capacity());
decoder.channelRead(ctx, buf); // BUG, No internal resource release!
buf = allocator.heapBuffer(inputChunks);
decoder.channelReadComplete(ctx);
}[ CVE-2021-20190 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, the blocked gadget is Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( |
🔬 Research Details[ CVE-2020-36188 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the [newrelic] (https://github.com/newrelic/newrelic-java-agent) gadget, an attacker can set When this library is included, an attacker can build a working exploit, and even automate this process by using ysoserial, a tool that finds gadgets and create payloads for vulnerable java deserializers. Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2020-36189 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, in the Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2020-36183 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the Apache Xalan (aka embedded Xalan) gadget, a JNDI controller called Specifically, with the docx4j gadget, which contains an embedded Apache Xalan gadget, a JNDI controller called Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2020-36184 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the Apache Tomcat dbcp2 gadget, an attacker can create an arbitrary Pool connection to DB by invoking When this library is included, an attacker can build a working exploit, and even automate this process by using ysoserial, a tool that finds gadgets and create payloads for vulnerable java deserializers. Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2020-36185 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the Apache Tomcat dbcp gadget, an attacker can create an arbitrary Pool connection to DB by invoking When this library is included, an attacker can build a working exploit, and even automate this process by using ysoserial, a tool that finds gadgets and create payloads for vulnerable java deserializers. Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2020-36186 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the Apache Tomcat dbcp gadget, an attacker can create an arbitrary Pool connection to DB by invoking When this library is included, an attacker can build a working exploit, and even automate this process by using ysoserial, a tool that finds gadgets and create payloads for vulnerable java deserializers. Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2020-36187 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the Apache Tomcat dbcp gadget, an attacker can create an arbitrary Pool connection to DB by invoking When this library is included, an attacker can build a working exploit, and even automate this process by using ysoserial, a tool that finds gadgets and create payloads for vulnerable java deserializers. Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2020-36179 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the dbcp in commons-dbcp gadget, an attacker can call Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2020-36180 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the dbcp2 in commons-dbcp gadget, an attacker can call Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2020-36181 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the Apache Tomcat dbcp gadget, Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2020-36182 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the Apache Tomcat dbcp2 gadget, Exploitation requires:
Remediation: Development mitigationsAvoid enabling default typing ( Deployment mitigationsRemove Development mitigationsAvoid using [ CVE-2020-35490 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the dbcp2 gadget, an attacker can create an arbitrary When this library is included, an attacker can build a working exploit, and even automate this process by using ysoserial, a tool that finds gadgets and create payloads for vulnerable java deserializers. Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2020-35491 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the Apache Xalan dbcp2 gadget, an attacker can create an arbitrary When this library is included, an attacker can build a working exploit, and even automate this process by using ysoserial, a tool that finds gadgets and create payloads for vulnerable java deserializers. Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2020-25649 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, the Exploitation requires:
Remediation: Development mitigationsAvoid enabling default typing ( Development mitigationsAvoid using [ CVE-2020-24750 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the pastdev.httpcomponents gadget, an attacker can Exploitation requires:
Remediation: Deployment mitigationsRemove `pastdev.httpcomponents`` from your Java classpath with the help of this guide Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2020-24616 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the pastdev.httpcomponents gadget, an attacker can Exploitation requires:
Remediation: Deployment mitigationsRemove `Anteros-DBCP`` from your Java classpath with the help of this guide Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2020-14195 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( |
🔬 Research Details[ CVE-2020-14060 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the [apache-xalan]( https://github.com/apache /xalan-j) gadget, a JNDI controller called Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2020-14061 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the Oracle-aq-jms gadget, an attacker can pivot JMS to load arbitrary classes by invoking When this library is included, an attacker can build a working exploit, and even automate this process by using ysoserial, a tool that finds gadgets and create payloads for vulnerable java deserializers. Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2020-14062 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with the Apache Xalan (aka embedded Xalan) gadget, a JNDI controller called Exploitation requires:
Remediation: Deployment mitigationsIf possible, remove Deployment mitigationsIf possible, remove [ CVE-2021-43797 ] io.netty:netty 3.10.6.FinalDescription: [ CVE-2021-21409 ] io.netty:netty 3.10.6.FinalDescription: [ CVE-2021-21295 ] io.netty:netty 3.10.6.FinalDescription: [ CVE-2020-13955 ] org.apache.calcite:calcite-core 1.19.0.7.1.9.0-387Description: [ CVE-2020-13955 ] org.apache.calcite:calcite-druid 1.19.0.7.1.9.0-387Description: [ CVE-2019-12384 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, the following classes were found to be able to cause remote code execution when used as Java gadgets - Exploitation requires:
Remediation: Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2019-12814 ] org.codehaus.jackson:jackson-mapper-asl 1.9.2Description:
Support for polymorphic type deserialization allows an attacker to create almost any class at the server-side, assuming an attacker-supplied JSON file is deserialized. The server-side creates the desired object by calling To exploit this issue, an attacker has to find code modules or functions included in the Java classpath that aren’t blacklisted by Jackson-databind, that will allow the attacker to perform operations with some security impact (such as remote code injection) when chained together. These code modules are also known as gadgets. Specifically, with JDOM gadget, the attacker can craft a special JSON request and lead to arbitrary read via unknown class inside Exploitation requires:
Remediation: Deployment mitigationsRemove Development mitigationsAvoid using Development mitigationsAvoid enabling default typing ( [ CVE-2021-21290 ] io.netty:netty 3.10.6.FinalDescription: Netty's In Netty prior to 4.1.77.Final, local information disclosure may occur when file uploads are stored on the disk, since they're created in the shared system temporary directory, using world-readable permissions. For files to be stored on the disk, the uploaded file size must exceed the This vulnerability's fix is incomplete. In order to completely fix the vulnerability, this CVE's patch must be applied together with CVE-2022-24823's patch. Unix-based operating systems are affected, as well as older versions of macOS and Windows, which share a temporary directory between all users. Additionally, only Netty applications running on Java 6 or lower are affected. Since Java 6 is an extremely old version, this greatly reduces the amount of potentially vulnerable machines. Remediation: Deployment mitigationsChange the configured JVM's Development mitigationsUse [ CVE-2024-23454 ] org.apache.hadoop:hadoop-common 2.10.2Description: |
❌ Build failed in 1h 8m 50sBuild command: mvn clean verify -B -e -Daudit -Djs.no.sandbox -pl \
shims/cdpdc71/driver,shims/dataproc1421,shims/dataproc1421/driver,shims/emr700/driver,shims/hdi40/driver❗ No tests found!ℹ️ This is an automatic message |
|
@singletonc @NJtwentyone Most of these vulnerabilities are false positives as we are not bringing these libraries in our builds, they are transitive dependencies and we have non-vulnerable versions in our jars. |
No description provided.