CODEWITHSUNDEEP
springspring-bootjacksondeserialization
laughingmonkey
laughingmonkey

Reputation: 41

What version of Jackson does spring-boot use?

I am trying to make sure I am using spring-boot and Jackson in a safe way. There is a deserialization bug in some versions of Jackson (source: https://github.com/FasterXML/jackson-databind/issues/1599).

By default Spring Security does not perform deserialization using Jackson, so this is an explicit choice of the user (source: https://pivotal.io/security/cve-2017-4995).

If Jackson is used to perform deserialization, versions 2.7, 2.8, 2.8.9 and 2.7.9.1, as well as 2.9.0.pr3 are patched (source: see cowtowncoder commented on Apr 13, https://github.com/FasterXML/jackson-databind/issues/1599) and not vulnerable to the bug.

Is it safe, then to perform deserialization using the version of Jackson that is part of spring, spring-boot, or Spring Security?

Upvotes: 3

Views: 8320

Answers (1)

Pytry
Pytry

Reputation: 6390

Every version of SpringBoot uses a vulnerable version of the Jackson API, since there really is no version that is not at least partially suceptable to attack. It can happen if you allow untrusted and third party data to be de-serialized into generic collections(Map<>, List<>. etc). Even if you are adding generics to these structures in you code, those generics are compile time only, and cannot enforce typing in the JVM runtime.

If you are accessing an external restful api, then you will have to implement your own typing. If you are using RestTemplate, this will have to be manually set on the object mapper it uses.

FYI: SpringBoot also uses a vulnerable version of logback. Just update to the latest version by explicitly including it in your build.

Upvotes: 5

Related Questions