Faster XML jackson-databind vulnerabilities

Question

We have recently upgraded Java web app a from DXA 1.5 to 1.8, however we found that there are security issues with jackson-databind versions before 2.9.8.

With DXA 1.8 we are getting jackson-databind version 2.8.3 only. We have tried to override the version to 2.9.8, but it causing exception in DD4T as below:

Servlet.service() for servlet [org.springframework.web.servlet.DispatcherServlet] in context with path [] threw exception [Handler processing failed; nested exception is java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.util.ClassUtil.findClass(Ljava/lang/String;)Ljava/lang/Class;] with root cause java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.util.ClassUtil.findClass(Ljava/lang/String;)Ljava/lang/Class; at org.dd4t.databind.serializers.json.TridionFieldTypeIdResolver.typeFromId(TridionFieldTypeIdResolver.java:97) at com.fasterxml.jackson.databind.jsontype.impl.TypeDeserializerBase._findDeserializer(TypeDeserializerBase.java:156)

---

Then we tried to upgrade the DD4T version, but that also failed with below exception:

SEVERE: Exception sending context initialized event to listener instance of class [org.springframework.web.context.ContextLoaderListener] org.springframework.beans.factory.BeanDefinitionStoreException: Failed to load bean class: com.sdl.dxa.DxaSpringInitialization; nested exception is java.io.FileNotFoundException: class path resource [org/dd4t/core/providers/BaseBrokerProvider.class] cannot be opened because it does not exist at org.springframework.context.annotation.ConfigurationClassPostProcessor.processConfigBeanDefinitions(ConfigurationClassPostProcessor.java:293) at org.springframework.context.annotation.ConfigurationClassPostProcessor.postProcessBeanDefinitionRegistry(ConfigurationClassPostProcessor.java:227) Caused by: java.io.FileNotFoundException: class path resource [org/dd4t/core/providers/BaseBrokerProvider.class] cannot be opened because it does not exist at org.springframework.core.io.ClassPathResource.getInputStream(ClassPathResource.java:157)

Can you please provide any suggestion on this.

Answer 1

The problem may be that you're trying to upgrade from jackson-databind v2.8 to v2.9, which may not be 100% compatible (it should have been if they respected semantic versioning, but unfortunately that is not always the case for 3rd party libraries).

Note that DXA 2.0 uses jackson-databind v2.9 already. It is using v2.9.4, so you may still want to upgrade to v2.9.8 to prevent any vulnerabilities, but that should be easier than upgrading from v2.8 to v2.9.

Also note that the vulnerabilities in jackson-databind are not really applicable to DXA. That is: DXA uses jackson-databind for deserialization of data coming from the CM/UDP system, not for deserialization of data coming from the client. So, these vulnerabilities cannot be exploited by malicious requests, but only by attacks from the inside (where someone should have managed to modify the JSON produced by the CM system).