Vulnerability Description
When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets". Spring Batch configures Jackson with global default typing enabled which means that through the previous exploit, arbitrary code could be executed if all of the following is true: * Spring Batch's Jackson support is being leveraged to serialize a job's ExecutionContext. * A malicious user gains write access to the data store used by the JobRepository (where the data to be deserialized is stored). In order to protect against this type of attack, Jackson prevents a set of untrusted gadget classes from being deserialized. Spring Batch should be proactive against blocking unknown "deserialization gadgets" when enabling default typing.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pivotal Software | Spring Batch | >= 4.0.0, <= 4.0.4 |
Related Weaknesses (CWE)
References
- https://tanzu.vmware.com/security/cve-2020-5411Vendor Advisory
- https://tanzu.vmware.com/security/cve-2020-5411Vendor Advisory
FAQ
What is CVE-2020-5411?
CVE-2020-5411 is a vulnerability with a CVSS score of 8.1 (HIGH). When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deseria...
How severe is CVE-2020-5411?
CVE-2020-5411 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-5411?
Check the references section above for vendor advisories and patch information. Affected products include: Pivotal Software Spring Batch.