Skip to content

CVE: jackson-databind 2.18.3 via fabric8 7.2.0 - two criticals (CVSS 9.2) #146

Description

@IraFischler

Summary

kafka-access-operator:0.3.0 ships jackson-databind:2.18.3, which is affected by two critical vulnerabilities. Unlike the jetty issue in #141, this one is not fixed on main either — main pins the same fabric8 version, so a 0.4.0 release would ship the same vulnerable jackson.

Vulnerability details

1. Incomplete list of disallowed inputs in BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()

  • CVSS v4.0 9.2 Critical (Snyk) / v3.1 8.1 High
  • Snyk ID: SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440366
  • The method allowlists an array based only on clazz.isArray() without validating the array's component type, so an attacker controlling the deserialized JSON can instantiate types outside the configured allowlist by wrapping them in an array.

2. Deserialization of untrusted data in DatabindContext._resolveAndValidateGeneric()

  • CVSS v4.0 9.2 Critical (Snyk) / v3.1 8.1 High
  • Snyk ID: SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440598
  • Only the raw container class of a type identifier is validated against the configured PolymorphicTypeValidator, not its nested generic type arguments. A denied class embedded as a generic parameter of an allowlisted container (e.g. java.util.ArrayList<com.evil.Gadget>) passes validation while the nested type is loaded and instantiated.

Both are fixed in jackson-databind 2.18.8 and 2.21.4.

Where it comes from

jackson is not declared anywhere in this project's poms. It arrives transitively:

kafka-access-operator  ->  fabric8.version 7.2.0  ->  jackson-bom 2.18.3

io.fabric8:kubernetes-client-project:7.2.0 sets <jackson.version>2.18.3</jackson.version> and imports jackson-bom at that version.

Current state

Checked both the 0.3.0 tag and main — each pins <fabric8.version>7.2.0</fabric8.version>, and neither declares a jackson version. So the next release will carry the same two criticals unless fabric8 is bumped or jackson is pinned explicitly.

Suggested fix

Bumping fabric8 looks like the cleaner option, but the target version matters:

fabric8 jackson
7.2.0 (current) 2.18.3
7.4.1 2.19.4
7.6.1 2.20.0
7.8.0 (latest) 2.21.4

Snyk lists fixed versions as only 2.18.8 and 2.21.4, which suggests the fix was backported to the 2.18 line and fixed forward in 2.21, leaving 2.19.x and 2.20.x unpatched. If that reading is right, fabric8 >= 7.8.0 is the first release that actually clears both — worth confirming against the advisories rather than taking my word for it.

Alternatively, pinning jackson-bom to >= 2.18.8 in dependencyManagement would fix it without moving fabric8, though that leaves jackson and fabric8 on divergent lines.

References

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions