CVE-2020-28491
📋 TL;DR
This vulnerability in Jackson CBOR data format library allows attackers to cause denial of service through memory exhaustion by sending specially crafted CBOR data. It affects applications using vulnerable versions of com.fasterxml.jackson.dataformat:jackson-dataformat-cbor to parse untrusted CBOR input. The vulnerability can lead to application crashes and resource exhaustion.
💻 Affected Systems
- com.fasterxml.jackson.dataformat:jackson-dataformat-cbor
📦 What is this software?
Quarkus by Quarkus
⚠️ Risk & Real-World Impact
Worst Case
Complete application outage due to OutOfMemoryError, potentially affecting multiple services in containerized environments where memory limits are shared.
Likely Case
Service disruption and denial of service for affected endpoints, requiring application restart to recover.
If Mitigated
Minimal impact with proper input validation, memory limits, and monitoring in place.
🎯 Exploit Status
Exploitation requires sending malicious CBOR data to vulnerable endpoints. Proof-of-concept available in GitHub issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.11.4 or 2.12.1
Vendor Advisory: https://github.com/FasterXML/jackson-dataformats-binary/commit/de072d314af8f5f269c8abec6930652af67bc8e6
Restart Required: Yes
Instructions:
1. Update dependency to 2.11.4 or 2.12.1 in build configuration (pom.xml or build.gradle). 2. Rebuild and redeploy application. 3. Restart affected services.
🔧 Temporary Workarounds
Input validation and size limits
allImplement size limits on incoming CBOR data and validate input before parsing
Memory limit enforcement
allSet JVM memory limits and container resource constraints to prevent system-wide impact
java -Xmx512m -jar yourapp.jar
🧯 If You Can't Patch
- Disable CBOR parsing for untrusted sources or implement strict input validation
- Implement circuit breakers and monitoring for memory usage spikes
🔍 How to Verify
Check if Vulnerable:
Check dependency version in pom.xml, build.gradle, or deployed JAR/WAR files for vulnerable versionsCheck Version:
mvn dependency:tree | grep jackson-dataformat-cbor OR gradle dependencies | grep jackson-dataformat-cborVerify Fix Applied:
Verify updated dependency version in build files and confirm application uses patched version📡 Detection & Monitoring
Log Indicators:
- java.lang.OutOfMemoryError
- High memory usage spikes
- Application crashes during CBOR parsing
Network Indicators:
- Unusually large CBOR payloads to application endpoints
- Repeated connection attempts with CBOR data
SIEM Query:
source="application.logs" AND ("OutOfMemoryError" OR "java.lang.OutOfMemoryError")🔗 References
- https://github.com/FasterXML/jackson-dataformats-binary/commit/de072d314af8f5f269c8abec6930652af67bc8e6
- https://github.com/FasterXML/jackson-dataformats-binary/issues/186
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONDATAFORMAT-1047329
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://github.com/FasterXML/jackson-dataformats-binary/commit/de072d314af8f5f269c8abec6930652af67bc8e6
- https://github.com/FasterXML/jackson-dataformats-binary/issues/186
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONDATAFORMAT-1047329
- https://www.oracle.com/security-alerts/cpujul2022.html
