Hacker News Reader

Comment by TicklishTiger | Hacker News Reader

How do you check if a machine is using jackson-databind?

You can unzip and look inside war files web-inf/lib (assuming it was packed with version number in file name) or you’d need to compare signatures of compiled classes packed into a jar file.

In other words, it’s quite difficult to do without running some scanning process designed to look for this library, and for specific versions of it that are vulnerable.

Not arguing, but since this news article is a specific link to the Debian Security tracker - the package is `libjackson2-databind-java` on Debian, presumably similar on others. If it was installed via package manager, `dpkg -l | grep jackson`, `rpm -qa | grep jackson` or similar on most Linux to possibly find it. I agree though that it's common for libraries like this to end up inside warballs.

jackson-databind is the name of the package on Fedora and on RHEL. We addressed this issue last week by updating to 2.10, though I think F30 and F31 updates still needs karma [0].

The other jackson packages are mostly Java package hierarchy that don't affect this CVE (jackson-core, jackson-bom, jackson-parent, and jackson-annotations -- but we've also updated all of these to 2.10 on F30+).

So:

    rpm -qa | grep jackson-databind

To the GGP:

As noted by other commenters just having the package isn't sufficient. You need a number of other libraries (most of which aren't shipped with Fedora, none of which are shipped on RHEL) on the classpath of the running JVM.

If you're not running any Java code, you're definitely not affected. If you're using any code distributed through the official channels, it is very unlikely that you're affected. You'll probably only be affected if you're using third-party projects. Which as always, are run at your own risk. :)

[0]: Source: co-maintainer of the package via the Fedora Stewardship SIG.

F30 Bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2019-b1715548... F31 Bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2019-cf87377f...

Reply on news.ycombinator.com