[ZOOKEEPER-3441] OWASP is flagging jackson-databind-2.9.9.jar for CVE-2019-12814

• Type: Task
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 3.6.0
• Fix Version/s: 3.6.0, 3.5.6
• Component/s: build, security
• Labels: pull-request-available
• Assignee: Patrick D. Hunt
• Reporter: Enrico Olivelli
• Created: 23/Jun/19 20:21
• Updated: 09/Oct/23 11:24
• Resolved: 12/Jul/19 05:33

Description

OWASP dependency checker is flagging jackson-databind-2.9.9.jar for CVE-2019-12814 (https://nvd.nist.gov/vuln/detail/CVE-2019-12814)
We should upgrade the library but we are currently using the latest and greatest 2.9.9.

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server.

We don't have jdom on the classpath, so we are not affected directly by this change, but users that are using ZooKeeper Server in a custom environment should take note of this issue

this is the issue on Jackson: https://github.com/FasterXML/jackson-databind/issues/2341

Issue Links

• links to: GitHub Pull Request #1014
• links to: github pull request #1014