jackson-databind Java Library Vulnerability: Early Warning
An early warning has been issued regarding a vulnerability in the jackson-databind Java library, which reportedly allows bypassing @JsonIgnore on Record properties using a PropertyNamingStrategy. This may lead to security issues as components that should be ignored can be set from the wire.
What happened
The jackson-databind Java library is under investigation for a vulnerability where the @JsonIgnore annotation on a Record property can be bypassed using a PropertyNamingStrategy. This vulnerability may allow components to be set from the wire that should otherwise be ignored, potentially leading to security issues.
Affected versions of jackson-databind include those greater than or equal to 2.15.0 but less than 2.18.8, greater than or equal to 2.19.0 but less than 2.21.4, and greater than or equal to 3.0.0 but less than 3.1.4.
To assess your exposure, check the versions of jackson-databind used in your projects. It is recommended to upgrade to version 2.18.8, 2.21.4, or 3.1.4 depending on the version line you are using. For more detailed information, consult the primary sources.
How 0Day mitigates this
jackson-databind is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.