About CVE-2020-36518 in Jackson

[mkurz]

To fix CVE-2020-36518 in your Play 2.8 application you need to upgrade to either latest Jackson 2.12.x or 2.13.x. Play 2.8 uses older Jackson 2.11, but unfortunately the Jackson developers won't backport the fix to the 2.11.x branch.
We don't plan to upgrade Jackson 2.11.x in Play 2.8.x as of now, since that might break existing Play applications.

Make sure to thoroughly test your application before putting it into production with an upgraded major Jackson version!

To upgrade Jackson you have to add this to your build.sbt:

val jacksonVersion         = "2.13.4"   // or 2.12.7
val jacksonDatabindVersion = "2.13.4.2" // or 2.12.7.1

val jacksonOverrides = Seq(
  "com.fasterxml.jackson.core"     % "jackson-core",
  "com.fasterxml.jackson.core"     % "jackson-annotations",
  "com.fasterxml.jackson.datatype" % "jackson-datatype-jdk8",
  "com.fasterxml.jackson.datatype" % "jackson-datatype-jsr310"
).map(_ % jacksonVersion)

val jacksonDatabindOverrides = Seq(
  "com.fasterxml.jackson.core" % "jackson-databind" % jacksonDatabindVersion
)

val akkaSerializationJacksonOverrides = Seq(
  "com.fasterxml.jackson.dataformat" % "jackson-dataformat-cbor",
  "com.fasterxml.jackson.module"     % "jackson-module-parameter-names",
  "com.fasterxml.jackson.module"     %% "jackson-module-scala",
).map(_ % jacksonVersion)

libraryDependencies ++= jacksonDatabindOverrides ++ jacksonOverrides ++ akkaSerializationJacksonOverrides

If you now run sbt dependencyTree or show runtime:fullClasspat you should see all the Jackson versions should be upgraded.

Also see:

• CVE-2020-36518
• [2.8.15] CVE-2020-36518 in Jackson #11217
• Jackson 2.13 #11219 (Upgrading to Jackson 2.13 in main branch)
• Jackson 2.13 play-json#740 (Upgrading to Jackson 2.13 in play-json main branch)
• jackson CVE-2020-36518 akka/akka#31282
• Upgrade jackson 2.13 version due to CVE akka/akka#31281 (akka stable branch keeps sticking on Jackson 2.11.x)

[ertra]

Hello,

I would like to ask please, would adding this:

"com.fasterxml.jackson.module" %% "jackson-module-scala" % "2.13.4"
be enough, it loads all other dependencies?

regards
tomas

[mkurz]

Actually it isn't enough. you can check with running dependencyTree, you will see that when adding only jackson-module-scala it will pull in:

[info]   +-com.fasterxml.jackson.module:jackson-module-scala_2.13:2.13.4 [S]
[info]   | +-com.fasterxml.jackson.core:jackson-annotations:2.13.4
[info]   | +-com.fasterxml.jackson.core:jackson-core:2.13.4
[info]   | +-com.fasterxml.jackson.core:jackson-databind:2.13.4
[info]   | | +-com.fasterxml.jackson.core:jackson-annotations:2.13.4
[info]   | | +-com.fasterxml.jackson.core:jackson-core:2.13.4
[info]   | | 
[info]   | +-com.thoughtworks.paranamer:paranamer:2.8

but not jackson-datatype-jdk8, jackson-datatype-jsr310, jackson-dataformat-cbor, etc. - these will stay on the old version.
I recommend to explictily define all those depencies, like in the above comment.

[dimon222]

I think the advice contains typo. The word libraryDependencies should be replaced with dependencyOverrides. I couldn't get stuff properly reflected otherwise.

[Nezisi]

libraryDependencies is the weaker form of an dependency override.

If a dependency in your project pulls Jackson 2.13, you have a libraryDependency with Jackson 2.14…

SBT should pick the 2.14, as it is the latest revision - with default conflict management.

But: In case of Jackson, all modules must be defined via libraryDependencies.

https://www.scala-sbt.org/1.x/docs/Library-Management.html#Conflict+Management

If a dependency pulls a higher revision than the one you defined via libraryDependencies, you must override with dependencyOverride.

Thus, if you have via libraryDependencies 2.14 and have e.g. logstash-logback-encoder in v7.4 which pulls 2.15… You will get 2.15 with the default conflict management as it is the highest revision.

With dependencyOverride SBT will forcefully override the version, performing an downgrade to 2.14 - despite logstash-logback-encoder pulling in the newer revision 2.15.