0

We have recently upgraded Java web app a from DXA 1.5 to 1.8, however we found that there are security issues with jackson-databind versions before 2.9.8.

With DXA 1.8 we are getting jackson-databind version 2.8.3 only. We have tried to override the version to 2.9.8, but it causing exception in DD4T as below:

Servlet.service() for servlet [org.springframework.web.servlet.DispatcherServlet] in context with path [] threw exception [Handler processing failed; nested exception is java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.util.ClassUtil.findClass(Ljava/lang/String;)Ljava/lang/Class;] with root cause java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.util.ClassUtil.findClass(Ljava/lang/String;)Ljava/lang/Class; at org.dd4t.databind.serializers.json.TridionFieldTypeIdResolver.typeFromId(TridionFieldTypeIdResolver.java:97) at com.fasterxml.jackson.databind.jsontype.impl.TypeDeserializerBase._findDeserializer(TypeDeserializerBase.java:156)


Then we tried to upgrade the DD4T version, but that also failed with below exception:

SEVERE: Exception sending context initialized event to listener instance of class [org.springframework.web.context.ContextLoaderListener] org.springframework.beans.factory.BeanDefinitionStoreException: Failed to load bean class: com.sdl.dxa.DxaSpringInitialization; nested exception is java.io.FileNotFoundException: class path resource [org/dd4t/core/providers/BaseBrokerProvider.class] cannot be opened because it does not exist at org.springframework.context.annotation.ConfigurationClassPostProcessor.processConfigBeanDefinitions(ConfigurationClassPostProcessor.java:293) at org.springframework.context.annotation.ConfigurationClassPostProcessor.postProcessBeanDefinitionRegistry(ConfigurationClassPostProcessor.java:227) Caused by: java.io.FileNotFoundException: class path resource [org/dd4t/core/providers/BaseBrokerProvider.class] cannot be opened because it does not exist at org.springframework.core.io.ClassPathResource.getInputStream(ClassPathResource.java:157)

Can you please provide any suggestion on this.

0

The problem may be that you're trying to upgrade from jackson-databind v2.8 to v2.9, which may not be 100% compatible (it should have been if they respected semantic versioning, but unfortunately that is not always the case for 3rd party libraries).

Note that DXA 2.0 uses jackson-databind v2.9 already. It is using v2.9.4, so you may still want to upgrade to v2.9.8 to prevent any vulnerabilities, but that should be easier than upgrading from v2.8 to v2.9.

Also note that the vulnerabilities in jackson-databind are not really applicable to DXA. That is: DXA uses jackson-databind for deserialization of data coming from the CM/UDP system, not for deserialization of data coming from the client. So, these vulnerabilities cannot be exploited by malicious requests, but only by attacks from the inside (where someone should have managed to modify the JSON produced by the CM system).

  • Thanks Rick for your response. We have the below response from SDL tridion team. – user2869 Mar 25 at 15:52
  • Back a few month ago, the Dev did release a CD hotfix that bring the Jackson API to version 2.9.4. So I believe you should be able to update the Jackson API to v2.9.8 by doing the following: 1) Apply CD_8.5.0.13167.zip to all microservice roles (Discovery, Deployer, Preview, etc...) Result, this should get the Jackson library to version 2.9.4 2) Apply CD_8.5.0.13495.zip to the rest API role Result, again, Jackson API is at version 2.9.4 3) Then update the Jackson API to 2.9.8 (jackson-annotations-2.9.8.jar, jackson-core-2.9.4.jar, jackson-databind-2.9.4.jar) – user2869 Mar 25 at 15:52
  • That applies to the Content Delivery subsystems (CIS & CIL), not to DXA, AFAIK. – Rick Pannekoek Mar 26 at 7:02
  • Thanks Rick, So what would you recommend. Since we cant upgrade to 2.0, we need to stick with 1.8. – user2869 Mar 26 at 14:44
  • I recommend upgrading to DXA 2.0. Why is that not an option? Alternatively, you could just accept the vulnerabilities (see my reasoning above). – Rick Pannekoek Mar 26 at 15:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.