search

akka / alpakka

Alpakka is a Reactive Enterprise Integration library for Java and Scala, based on Reactive Streams and Akka.
https://doc.akka.io/docs/alpakka/current/
Other
1.26k stars 645 forks source link

Jackson Databind vulnerability #793

Closed johanandren closed 5 years ago

johanandren commented 6 years ago

There are a couple of quite serious vulnerabilities (potentially remote code execution) in jackson-databind:

Among the Alpakka modules older versions are pulled in (directly or transitively) by:

I think all these needs to be updated

takezoe commented 6 years ago

I investigated the status of Jackson dependency in each connector. The summary is as follows:

elasticsearch

Upgraded in #804

kinesis, s3, sns, sqs, awslambda, dynamodb

Jackson dependency in these connectors are comming from aws-sdk-java. I sent a pull request to aws-sdk-java to upgrade Jackson: https://github.com/aws/aws-sdk-java/pull/1480

However aws-sdk-java have to support Java 6 and some of fixes for Jackson vulnerabilities have not been backported to Jackson 2.6.x which is for Java 6. Hence, we might have to overwrite Jackson dependency in Alpakka side.

azure-storage-queue

Same as aws-sdk-java in the point of Java 6 support. I created an issue instead of sending a pull request: https://github.com/Azure/azure-storage-java/issues/264

geode

Jackson was upgraded in develop branch recently: https://github.com/apache/geode/commit/c076bef6471f43e227531c4829dd90b32931dd23#diff-1fa89afcc2bb350e76df4a548d82c912R46 We can wait for the next geode release.

orientdb

I sent a pull request to orientdb repository: https://github.com/orientechnologies/orientdb/pull/8118

Note: orientdb has dependency to blueprints and blueprints has a dependency to old version of Jackson. But I guess it will be evicted by the latest version of Jackson if above pull request is merged.

ennru commented 6 years ago

Great investigation work @takezoe ! Thank you.

cowtowncoder commented 6 years ago

Since the vulnerability (all cves listed rely on one main mechanism) is not widely understood (although reports do usually explain the general idea), I wrote:

https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062

and from that one suggestion I would make is to ensure that Default Typing is not enabled by default. It is not enabled by default for new ObjectMappers, and frameworks/libs should not enable it for untrusted content. This prevents all above problems as well as possibly unknown future ones.

I realize that many automated CVE/vulnerability checkers only have binary yes/no condition based on versions (which is unfortunate) so version upgrades are often necessary just to be safe.

takezoe commented 6 years ago

Status updated:

kinesis, s3, sns, sqs, awslambda, dynamodb

Pull request has been rejected to keep Java 6 support, but aws-sdk-java-v2 seems to use newer version of Jackson. Maybe we should switch to that (in the future).

Upgrading to AWS SDK2 has been discussed in #372.

orientdb

Pull request has been merged. We can wait for the next release.

takezoe commented 6 years ago

@cowtowncoder I think possibility of being actually affected by Jackson's vulnerabilities is not so high in Alpakka (and a lot of other Java softwares). However I also think upgrading dependent libraries is a good habit bascally. In particular, foundation libraries have a possibility to make a large impact because they are used from a lot of other softwares.

cowtowncoder commented 6 years ago

@takezoe yes absolutely upgrade makes sense, I fully agree. I just wanted link some more information on sec vuln itself.

ennru commented 5 years ago

AWS SDK 2.5.20 has upgraded those dependencies to com.fasterxml.jackson.core jackson-databind 2.9.8 so AWS Lambda, SQS and SNS are from this vulnerability.

ennru commented 5 years ago

With #1777 merged all connectors are on Jackson Databind 2.9.9.

ennru commented 5 years ago

Closing this for the upcoming release.