GHSA-q95j-488q-5q3p Apiman Manager API affected by Jackson denial of service vulnerability

Q: Which versions are affected by GHSA-q95j-488q-5q3p?

2 open source packages ship an affected version, including io.apiman:apiman-manager-api-impl.

Q: Is GHSA-q95j-488q-5q3p being exploited?

There is no known exploitation of GHSA-q95j-488q-5q3p in the wild and no public exploit code.

Q: How do I fix GHSA-q95j-488q-5q3p?

Upgrade io.apiman:apiman-manager-api-impl to 3.0.0.Final or later.

Not scored Published 9 Jan 2023

An authenticated attacker can cause a denial of service on the Apiman Manager API by crafting a malicious policy configuration.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-q95j-488q-5q3p?

GHSA-q95j-488q-5q3p is a denial of service vulnerability in io.apiman:apiman-manager-api-impl, published on 9 Jan 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Impact

Due to a vulnerability in jackson-databind <= 2.12.6.0, an authenticated attacker could craft an Apiman policy configuration which, when saved, may cause a denial of service on the Apiman Manager API.

This does not affect the Apiman Gateway.

Patches

Upgrade to Apiman 3.0.0.Final or later.

If you are using an older version of Apiman and need to remain on that version, contact your Apiman support provider for advice/long-term support.

Workarounds

If all users of the Apiman Manager are trusted then you may assess this is low risk, as an account is required to exploit the vulnerability.

References

Apiman maintainer and security contact: [email protected]
https://nvd.nist.gov/vuln/detail/CVE-2020-36518
https://github.com/FasterXML/jackson-databind/issues/2816

Which versions are affected by GHSA-q95j-488q-5q3p?