MavenGate (CVE) -- Jackson 2.x NOT AFFECTED

[diyfr]

Xray triggers an alert on jackson-databind,jackson-core and jackson-annotations:
https://blog.oversecured.com/Introducing-MavenGate-a-supply-chain-attack-method-for-Java-and-Android-applications
https://www.sonatype.com/sonatypes-ongoing-commitment-to-maven-central

[JooHyukKim]

Xray triggers an alert on jackson-databind,jackson-core and jackson-annotations:

Which part from the contents of shared link shows the triggered alert?

[diyfr]

@JooHyukKim No more detail from xray(in ide), it's low, it's "susceptible" 🤔
https://twitter.com/JFrogSecurity/status/1750445448584626405
No details...

Dns record problem?

On classical springboot project (3.2.x), only this packages triggers an low alert :

• com.fasterxml.jackson.core:jackson-databind
• com.fasterxml.jackson.core:jackson-core
• com.fasterxml.jackson.core:jackson-annotations
• io.swagger.core.v3:swagger-core-jakarta
• io.swagger.core.v3:swagger-models-jakarta
• io.swagger.core.v3:swagger-annotations-jakarta
• org.slf4j:slf4j-api
• org.slf4j:jul-to-slf4j

[pjfanning]

If someone wants to give us the results, we will look at them. This is a genuine issue but with a lot of companies overselling it to earn a buck. I'm not in the mind to provide my email address to oversecured to get their list.

The top 20 list on their blog contains at least one incorrect entry - fs2.co appears to redirect to fs2.io which I think is fine.

http://fasterxml.com/ works.

If any company is concerned, maybe they should offer to pay for the domain names. Would quickly sort out some of the issues.

[cowtowncoder]

Yeah, this is an entirely theoretical concern: no one will be able to take over Jackson Maven publishing, even without DNS registration. Release process is gated by Sonatype admins who know what they are doing wrt verifications.

[yawkat]

there's a real concern that someone could grab a domain and register with a non-central maven repo (like jitpack). then, users of central + that non-central repo could get served malicious artifacts.

however i don't see how this is an issue with jackson since fasterxml.com is registered.

[cowtowncoder]

Right, fasterxml.com is indeed registered to make that point moot (not sure why it'd be considered available or something). I did not think Jackson was listed in vulnerable projects in the original article so was bit surprised by claim here.

But I am not sure how non-MC repo approach would work wrt syncing. I assume there may be some cases where this could indeed be problematic, with new versions being pushed and MC allows syncing from elsewhere even if it was the originator for previous versions (which I supposed would make sense if projects legitimately moved to use different Maven repo as their publishing target).

[cowtowncoder]

FWTW I double-checked my registration of "fasterxml.com" domain: it expires on Dec 29, 2026 but has been registered for more than a decade (and I intend to pay for it, and "jackson.tools") for however long necessary.
Where the claim that it is up for grabs comes from I don't know but the domain is definitely not abandoned.
A slight clue might be -- just as an example -- checking what is served via http://fasterxml.com/.

I am somewhat annoyed by seemingly Yet Another Security Tool Fail. Why is it always up to projects to "prove they are not guilty" as opposed to security researchers perhaps providing some actual support evidence for an issue?

[JooHyukKim]

Reminds me of Express.js spam PR incidents.
I am not saying that security reports are all spams.
They are similar in sense that it all results to fatigue of maintainers.

[diyfr]

for informations, in this file vulnerable.txt i found jackson-bean-validation.org
(file from https://blog.oversecured.com/Introducing-MavenGate-a-supply-chain-attack-method-for-Java-and-Android-applications/#total-number-of-vulnerable-dependencies )

[pjfanning]

Jackson does not use that URL as a groupId. These companies are exaggerating to sell you software. Please stop spamming us about it.

[cowtowncoder]

Also, whatever "jackson-bean-validation.org" is used by, it's not a component maintained by Jackson project (nor under FasterXML repo).

[yonisa3]

Hi, this is Jonathan from the Xray team in JFrog.
I can confirm that flagging jackson-databind as affected by the MavenGate attack was a false positive of our product due to a typo when we classified the affected components list.
In the affected list by OverSecured you can find om.fasterxml.jackson.core which is a different package. We mistakenly considered it as the com.fasterxml domain.
We fixed our data so Xray does not flag this package incorrectly anymore.
Apologies for the confusion.

[pjfanning]

Thanks @yonisa3 for looking into this.

[diyfr]

Nice !!