FasterXML Jackson-databind CVE-2018-12023 Remote Code Execution Vulnerability
BID:105659
CVE-2018-12023 |Info
FasterXML Jackson-databind CVE-2018-12023 Remote Code Execution Vulnerability
| Bugtraq ID: | 105659 |
| Class: | Design Error |
| CVE: |
CVE-2018-12023 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 08 2018 12:00AM |
| Updated: | Jul 17 2019 07:00AM |
| Credit: | Tatu Saloranta |
| Vulnerable: |
Oracle Utilities Advanced Spatial and Operational Analytics 2.7.0.1 Oracle Retail Merchandising System 15.0 Oracle Primavera Unifier 18.8 Oracle Primavera Unifier 18.1 Oracle Primavera Unifier 17.12 Oracle Primavera Unifier 17.1 Oracle Primavera Unifier 16.2 Oracle Primavera Unifier 16.1 Oracle Primavera Unifier 15.2 Oracle Primavera Unifier 15.1 Oracle JD Edwards EnterpriseOne Tools 9.2 Oracle Enterprise Manager for Virtualization 13.3.1 Oracle Enterprise Manager for Virtualization 13.2.3 Oracle Enterprise Manager for Virtualization 13.2.2 Oracle Communications Instant Messaging Server 10.0.1.2.0 Oracle Banking Platform 2.6.2 Oracle Banking Platform 2.6.1 Oracle Banking Platform 2.6 Oracle Banking Platform 2.5.0 FasterXML jackson-databind 2.9.5 FasterXML jackson-databind 2.9.4 FasterXML jackson-databind 2.9.2 FasterXML jackson-databind 2.9.1 FasterXML jackson-databind 2.9 FasterXML jackson-databind 2.8.11 FasterXML jackson-databind 2.8.11.1 FasterXML jackson-databind 2.7.9.3 FasterXML jackson-databind 2.7.9.1 |
| Not Vulnerable: |
FasterXML jackson-databind 2.9.6 FasterXML jackson-databind 2.8.11.2 FasterXML jackson-databind 2.7.9.4 |
Discussion
FasterXML Jackson-databind CVE-2018-12023 Remote Code Execution Vulnerability
FasterXML Jackson-databind is prone to a remote-code execution vulnerability.
Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application. Failed exploits will result in denial-of-service conditions.
jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6 are vulnerable.
FasterXML Jackson-databind is prone to a remote-code execution vulnerability.
Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application. Failed exploits will result in denial-of-service conditions.
jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6 are vulnerable.
Exploit / POC
FasterXML Jackson-databind CVE-2018-12023 Remote Code Execution Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
FasterXML Jackson-databind CVE-2018-12023 Remote Code Execution Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
FasterXML Jackson-databind CVE-2018-12023 Remote Code Execution Vulnerability
References:
References:
- CVE-2018-12023: Block polymorphic deserialization of types from Oracle JDBC (FAsterXML)
- FasterXML/jackson-databind Home Page (FasterXML)
- Oracle Critical Patch Update Advisory - April 2019 (Oracle)
- Oracle Critical Patch Update Advisory - January 2019 (Oracle)
- Oracle Critical Patch Update Advisory - July 2019 (Oracle)
- Oracle Critical Patch Update Advisory - October 2018 (Oracle)