Description
Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | jodd | No fix yet | — |
| Ubuntu 20.04 LTS | jodd | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jodd:jodd-json | < 5.0.4 | 5.0.4 | GHSA-jrg3-qq99-35g7 |
References
- https://github.com/oblac/jodd/issues/628
- https://github.com/oblac/jodd/compare/v5.0.3...v5.0.4
- https://github.com/oblac/jodd/commit/9bffc3913aeb8472c11bb543243004b4b4376f16
- [hive-issues] 20210423 [jira] [Assigned] (HIVE-25054) Upgrade jodd-core due to CVE-2018-21234 mailing-list
- [hive-dev] 20210423 [jira] [Created] (HIVE-25054) Upgrade jodd-core due to CVE-2018-21234 mailing-list
- [hive-issues] 20210423 [jira] [Work started] (HIVE-25054) Upgrade jodd-core due to CVE-2018-21234 mailing-list
- [hive-issues] 20210423 [jira] [Updated] (HIVE-25054) Upgrade jodd-core due to CVE-2018-21234 mailing-list
- [hive-gitbox] 20210423 [GitHub] [hive] achennagiri opened a new pull request #2217: HIVE:25054 Upgrade `jodd-core` dependency to get rid of CVE-2018-21234 mailing-list
- [hive-issues] 20210518 [jira] [Commented] (HIVE-25054) Upgrade jodd-core due to CVE-2018-21234 mailing-list
- [hive-gitbox] 20210520 [GitHub] [hive] achennagiri commented on a change in pull request #2217: HIVE:25054 Upgrade `jodd-core` dependency to get rid of CVE-2018-21234 mailing-list
- [hive-issues] 20210521 [jira] [Resolved] (HIVE-25054) Upgrade jodd-core due to CVE-2018-21234 mailing-list
- [hive-gitbox] 20210521 [GitHub] [hive] jcamachor merged pull request #2217: HIVE:25054 Upgrade `jodd-core` dependency to get rid of CVE-2018-21234 mailing-list
- [hive-issues] 20210524 [jira] [Commented] (HIVE-25054) Upgrade jodd-core due to CVE-2018-21234 mailing-list
- [drill-dev] 20210810 [GitHub] [drill] ssainz opened a new issue #2294: CVE-2018-21234 in Hive 3.1.2, should upgrade to 3.21.3 mailing-list