Performance issue with malicious BigDecimal input, InstantDeserializer, DurationDeserializer (CVE-2018-1000873) #90
Description
(note: moved from FasterXML/jackson-databind#2141 reported by @plokhotnyuk)
It looks the same as: playframework/play-json#180
Reproduced by the following commit: plokhotnyuk/jsoniter-scala@0d53faf
The security bug is in InstantDeserializer and DurationDeserializer of the jackson-datatype-jsr310 artifact:
protected T _fromDecimal(DeserializationContext context, BigDecimal value)
{
long seconds = value.longValue(); // <- hangs in case of 10000000e100000000
int nanoseconds = DecimalUtils.extractNanosecondDecimal(value, seconds);
return fromNanoseconds.apply(new FromDecimalArguments(
seconds, nanoseconds, getZone(context)));
}
W/A is to use custom serializers for all types that are parsed with InstantDeserializer and DurationDeserializer by registering them after (or instead of) registration of the JavaTimeModule module.