SAS Statement Regarding jackson-databind Polymorphic Deserialization Vulnerabilities

Reference Name: jackson-databind Polymorphic Deserialization Vulnerabilities

Severity: Informational

Status: No action is required by customers

History

07-13-2021 – New CVE entries added.

04-01-2020 – Assessment Completed

Impact

SAS software is not exposed to the following jackson-databind deserialization vulnerabilities:

• CVE-2017-7525
• CVE-2017-15095
• CVE-2017-17485
• CVE-2018-5968
• CVE-2018-7489
• CVE-2018-14718
• CVE-2018-14719
• CVE-2018-14720
• CVE-2018-14721
• CVE-2018-19360
• CVE-2018-19361
• CVE-2018-19362
• CVE-2018-1000873
• CVE-2019-10202
• CVE-2019-12086
• CVE-2019-12384
• CVE-2019-14892
• CVE-2019-14893
• CVE-2019-16942
• CVE-2019-16943
• CVE-2019-17267
• CVE 2019-17531
• CVE-2019-20330
• CVE-2020-8840
• CVE-2020-9546
• CVE-2020-9547
• CVE-2020-9548
• CVE 2020-10672
• CVE 2019-10673
• CVE 2019-10968
• CVE 2019-10969
• CVE 2020-11111
• CVE 2020-11112
• CVE 2020-11113
• CVE-2020-11619
• CVE-2020-11620
• CVE-2020-14060
• CVE-2020-14061
• CVE-2020-14062
• CVE-2020-14195
• CVE-2020-24616
• CVE-2020-24750
• CVE-2020-25649
• CVE-2020-35490
• CVE-2020-35491
• CVE-2020-35728
• CVE-2020-36179
• CVE-2020-36180
• CVE-2020-36181
• CVE-2020-36182
• CVE-2020-36183
• CVE-2020-36184
• CVE-2020-36185
• CVE-2020-36186
• CVE-2020-36187
• CVE-2020-36188
• CVE-2020-36189
• CVE-2021-20190

Description

The jackson-databind library has known, remote-code execution vulnerabilities resulting from a flaw that allows polymorphic deserialization of potentially malicious objects.

Solution

No SAS^® software uses jackson-databind Default Typing and polymorphic deserialization. Therefore, SAS is not vulnerable to this issue, and no customer action is required to fix this vulnerability.