About CVE-2020-36518 in Jackson

[mkurz]

To fix CVE-2020-36518 in your Play 2.8 application you need to upgrade to either latest Jackson 2.12.x or 2.13.x. Play 2.8 uses older Jackson 2.11, but unfortunately the Jackson developers won't backport the fix to the 2.11.x branch.
We don't plan to upgrade Jackson 2.11.x in Play 2.8.x as of now, since that might break existing Play applications.

Make sure to thoroughly test your application before putting it into production with an upgraded major Jackson version!

To upgrade Jackson you have to add this to your build.sbt:

val jacksonVersion         = "2.13.4"   // or 2.12.7
val jacksonDatabindVersion = "2.13.4.2" // or 2.12.7.1

val jacksonOverrides = Seq(
  "com.fasterxml.jackson.core"     % "jackson-core",
  "com.fasterxml.jackson.core"     % "jackson-annotations",
  "com.fasterxml.jackson.datatype" % "jackson-datatype-jdk8",
  "com.fasterxml.jackson.datatype" % "jackson-datatype-jsr310"
).map(_ % jacksonVersion)

val jacksonDatabindOverrides = Seq(
  "com.fasterxml.jackson.core" % "jackson-databind" % jacksonDatabindVersion
)

val akkaSerializationJacksonOverrides = Seq(
  "com.fasterxml.jackson.dataformat" % "jackson-dataformat-cbor",
  "com.fasterxml.jackson.module"     % "jackson-module-parameter-names",
  "com.fasterxml.jackson.module"     %% "jackson-module-scala",
).map(_ % jacksonVersion)

libraryDependencies ++= jacksonDatabindOverrides ++ jacksonOverrides ++ akkaSerializationJacksonOverrides

If you now run sbt dependencyTree or show runtime:fullClasspat you should see all the Jackson versions should be upgraded.

Also see:

• CVE-2020-36518
• [2.8.15] CVE-2020-36518 in Jackson #11217
• Jackson 2.13 #11219 (Upgrading to Jackson 2.13 in main branch)
• Jackson 2.13 play-json#740 (Upgrading to Jackson 2.13 in play-json main branch)
• jackson CVE-2020-36518 akka/akka#31282
• Upgrade jackson 2.13 version due to CVE akka/akka#31281 (akka stable branch keeps sticking on Jackson 2.11.x)

[ertra]

Hello,

I would like to ask please, would adding this:

"com.fasterxml.jackson.module" %% "jackson-module-scala" % "2.13.4"
be enough, it loads all other dependencies?

regards
tomas

[mkurz]

Actually it isn't enough. you can check with running dependencyTree, you will see that when adding only jackson-module-scala it will pull in:

[info]   +-com.fasterxml.jackson.module:jackson-module-scala_2.13:2.13.4 [S]
[info]   | +-com.fasterxml.jackson.core:jackson-annotations:2.13.4
[info]   | +-com.fasterxml.jackson.core:jackson-core:2.13.4
[info]   | +-com.fasterxml.jackson.core:jackson-databind:2.13.4
[info]   | | +-com.fasterxml.jackson.core:jackson-annotations:2.13.4
[info]   | | +-com.fasterxml.jackson.core:jackson-core:2.13.4
[info]   | | 
[info]   | +-com.thoughtworks.paranamer:paranamer:2.8

but not jackson-datatype-jdk8, jackson-datatype-jsr310, jackson-dataformat-cbor, etc. - these will stay on the old version.
I recommend to explictily define all those depencies, like in the above comment.

[dimon222]

I think the advice contains typo. The word libraryDependencies should be replaced with dependencyOverrides. I couldn't get stuff properly reflected otherwise.

[Nezisi]

libraryDependencies is the weaker form of an dependency override.

If a dependency in your project pulls Jackson 2.13, you have a libraryDependency with Jackson 2.14…

SBT should pick the 2.14, as it is the latest revision - with default conflict management.

But: In case of Jackson, all modules must be defined via libraryDependencies.

https://www.scala-sbt.org/1.x/docs/Library-Management.html#Conflict+Management

If a dependency pulls a higher revision than the one you defined via libraryDependencies, you must override with dependencyOverride.

Thus, if you have via libraryDependencies 2.14 and have e.g. logstash-logback-encoder in v7.4 which pulls 2.15… You will get 2.15 with the default conflict management as it is the highest revision.

With dependencyOverride SBT will forcefully override the version, performing an downgrade to 2.14 - despite logstash-logback-encoder pulling in the newer revision 2.15.

[rtyley]

We just came across SNYK-JAVA-COMFASTERXMLJACKSONCORE-7569538 (no CVE yet, apparently), which is a 'high' vulnerability published on 26th July 2024, that apparently requires updating to Jackson 2.15 (apparently the latest version of Jackson is 2.17). The fix hasn't been backported to earlier Jackson versions, so far as I can tell.

Just to check Play's policy on Jackson updates, Play can only make 'patch' version upgrades on Jackson while maintaining the same Play 'major.minor' release version, is that right? So the first version of Play that could contain Jackson 2.15 would be Play 3.1, given that Play is on v3.0.5 (and Jackson 2.14.3) at the moment?

Related PRs (with some challenges due to failing tests):

• Jackson 2.15.4 (was 2.14.3) #12440
• jackson-databind 2.16.1 (was 2.14.3) #12296

[mkurz]

no CVE yet, apparently

There will never be a CVE because this "issue" is not a 'high' vulnerability.

published on 26th July 2024

This is not correct. If you look closer, the report was published on 8 Dec 2022 already, it's nothing new. If you look at the discussion in the jackson repo (FasterXML/jackson-core#861) you will find out that the jackson maintainers got a bit annoyed the this so called "disclosure". If I read this right, what happend is that a commit made it into jackson (FasterXML/jackson-core@3af7e3e), like total normal development, nothing special, to limit the sizes of numbers, then someone reported this as "vulnerability", which never was, because nothing was ever exploited in the wild. The fix never was intented to fix a vulnerability, the commit was done on Nov 29, 2022, the report was filed one week later on Dec 8, 2022. But of course everone got nervos when security alerts pop up...
IMHO you don't need to worry abou this report.

So the first version of Play that could contain Jackson 2.15 would be Play 3.1, given that Play is on v3.0.5 (and Jackson 2.14.3) at the moment?

Yes, plan is to upgrade to latest Jackson in the next upcoming release.
I know about the open PRs, they will be worked on.

[rtyley]

@mkurz - thank you for that background, including the pointer to FasterXML/jackson-core#861 - much appreciated.