Git Product home page Git Product logo

cve-2020-8841's Introduction

漏洞描述

jackson-databind是一套开源java高性能JSON处理器,受影响版本的jackson-databind中由于缺少某些xbean-reflect/JNDI黑名单类,如org.apache.xbean.propertyeditor.JndiConverter,可导致攻击者使用JNDI注入的方式实现远程代码执行,漏洞需要配合xbean-reflect-*.jar组件才能成功利用,影响面适中。

危害等级

CVE-2020-8840 中危

影响版本

  • jackson-databind 2.9系列 < 2.9.10.3

  • jackson-databind 2.8系列 < 2.8.11.5

  • jackson-databind 低于2.8系列

安全版本

  • jackson-databind 2.10系列 全版本

  • jackson-databind 2.9系列 >= 2.9.10.3

  • jackson-databind 2.8系列 >= 2.8.11.5

安全测试情况

安全建议

以下任意一种方法均可实现漏洞修复

  1. 针对使用到jackson-databind组件的web服务升级jackson-databind组件至安全版本:https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-databind/2.9.10.3/

https://github.com/FasterXML/jackson-databind/releases

  1. 针对无法升级jackson-databind的,排查并将xbean-reflect-*.jar组件从应用依赖中移除可阻止漏洞攻击(可能会导致应用不可用风险)

参考来源

cve-2020-8841's People

Watchers

 avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.