FasterXML Jackson-databind Polymorphic Deserialization Multiple Security Vulnerability
BID:109276
Info
FasterXML Jackson-databind Polymorphic Deserialization Multiple Security Vulnerability
| Bugtraq ID: | 109276 |
| Class: | Unknown |
| CVE: |
CVE-2018-14719 CVE-2018-14720 CVE-2018-14721 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 24 2018 12:00AM |
| Updated: | Oct 24 2018 12:00AM |
| Credit: | The vendor reported these issues. |
| Vulnerable: |
Redhat Software Collections 1 for RHEL Workstation 7 0 Redhat Software Collections 1 for RHEL 7 0 Redhat Software Collections 1 for RHEL 7.6 Redhat Software Collections 1 for RHEL 7.5 Redhat Software Collections 1 for RHEL 7.4 Redhat OpenShift Container Platform 3.11 Redhat JBoss Middleware Text-Only Advisories for MIDDLEWARE 1 Oracle WebCenter Portal 12.2.1.3.0 Oracle Retail Merchandising System 16.0 Oracle Retail Merchandising System 15.0 Oracle Primavera Unifier 18.8 Oracle Primavera Unifier 17.7 Oracle Primavera Unifier 17.12 Oracle Primavera Unifier 16.2 Oracle Primavera Unifier 16.1 Oracle Primavera P6 Enterprise Project Portfolio Management 18.8 Oracle Primavera P6 Enterprise Project Portfolio Management 17.7 Oracle Primavera P6 Enterprise Project Portfolio Management 17.12 Oracle Primavera P6 Enterprise Project Portfolio Management 16.2 Oracle Primavera P6 Enterprise Project Portfolio Management 16.1 Oracle Primavera P6 Enterprise Project Portfolio Management 15.2 Oracle Primavera P6 Enterprise Project Portfolio Management 15.1 Oracle JDeveloper 12.2.1.3.0 Oracle JDeveloper 12.1.3.0.0 Oracle Financial Services Analytical Applications Infrastructure 8.0.7 Oracle Financial Services Analytical Applications Infrastructure 8.0.6 Oracle Financial Services Analytical Applications Infrastructure 8.0.5 Oracle Financial Services Analytical Applications Infrastructure 8.0.4 Oracle Financial Services Analytical Applications Infrastructure 8.0.3 Oracle Financial Services Analytical Applications Infrastructure 8.0.2 Oracle Enterprise Manager for Virtualization 13.3.1 Oracle Enterprise Manager for Virtualization 13.2.3 Oracle Enterprise Manager for Virtualization 13.2.2 Oracle Communications Billing and Revenue Management 7.5 Oracle Communications Billing and Revenue Management 12.0 Oracle Clusterware 12.1.0.2.0 Oracle Business Process Management Suite 12.2.1.3.0 Oracle Business Process Management Suite 12.1.3.0.0 Oracle Banking Platform 2.6.2 Oracle Banking Platform 2.6.1 Oracle Banking Platform 2.6 Oracle Banking Platform 2.5.0 FasterXML jackson-databind 2.9.6 FasterXML jackson-databind 2.9.5 FasterXML jackson-databind 2.9.4 FasterXML jackson-databind 2.9.2 FasterXML jackson-databind 2.9.1 FasterXML jackson-databind 2.9 FasterXML jackson-databind 2.8.11 FasterXML jackson-databind 2.8.10 FasterXML jackson-databind 2.8.9 FasterXML jackson-databind 2.8.8 FasterXML jackson-databind 2.8.7 FasterXML jackson-databind 2.8.8.1 FasterXML jackson-databind 2.8.11.2 FasterXML jackson-databind 2.8.11.1 FasterXML jackson-databind 2.8 FasterXML jackson-databind 2.7.9.4 FasterXML jackson-databind 2.7.9.3 FasterXML jackson-databind 2.7.9.1 FasterXML jackson-databind 2.7 FasterXML jackson-databind 2.6.7.1 FasterXML jackson-databind 2.6 FasterXML jackson-databind 2.5 FasterXML jackson-databind 2.4 FasterXML jackson-databind 2.3 |
| Not Vulnerable: |
FasterXML jackson-databind 2.9.7 |
Discussion
FasterXML Jackson-databind Polymorphic Deserialization Multiple Security Vulnerability
FasterXML Jackson-databind is prone to multiple security vulnerabilities.
Successfully exploiting these issues may allow an attacker to execute arbitrary code, bypass certain security restrictions, perform unauthorized actions or obtain potentially sensitive information. Failed exploits may result in denial-of-service conditions.
FasterXML jackson-databind versions 2.x through 2.9.6 are vulnerable.
FasterXML Jackson-databind is prone to multiple security vulnerabilities.
Successfully exploiting these issues may allow an attacker to execute arbitrary code, bypass certain security restrictions, perform unauthorized actions or obtain potentially sensitive information. Failed exploits may result in denial-of-service conditions.
FasterXML jackson-databind versions 2.x through 2.9.6 are vulnerable.
Exploit / POC
FasterXML Jackson-databind Polymorphic Deserialization Multiple Security Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
FasterXML Jackson-databind Polymorphic Deserialization Multiple Security Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
FasterXML Jackson-databind Polymorphic Deserialization Multiple Security Vulnerability
References:
References:
- FasterXML/jackson-databind Home Page (FasterXML)
- Fix #2097 for 2.6.7.2 (FasterXML)
- Jackson Release 2.9.7 (FasterXML)
- Oracle Critical Patch Update Advisory - April 2019 (Oracle)
- Oracle Critical Patch Update Advisory - January 2019 (Oracle)
- Oracle Critical Patch Update Advisory - July 2019 (Oracle)
- RHBA-2019:0959 - Bug Fix Advisory (RedHat)
- RHSA-2019:0782 - Security Advisory (Red Hat)
- RHSA-2019:0877 - Security Advisory (Red Hat)
- RHSA-2019:1782 - Security Advisory (RedHat)
- RHSA-2019:1797 - Security Advisory (RedHat)