NetSight
IP …
medium6.5

CVE-2018-1000873

Moderate severity vulnerability that affects com.fasterxml.jackson.datatype:jackson-datatype-jsr353

Impact

Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Databind that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.

Affected packages

EcosystemPackageAffectedFixed in
mavencom.fasterxml.jackson.datatype:jackson-datatype-jsr310< 2.9.82.9.8

Affected products

VendorProductAffected versions
FasterxmlJackson-Modules-Java8
before 2.9.8
OracleClusterware
Version 12.1.0.2.0
OracleDatabase Server
Versions 12.1.0.2, 12.2.0.1, 18c, 19c
OracleGlobal Lifecycle Management Opatch
before 11.2.0.3.23
from 12.2.0.1.0 before 12.2.0.1.19
from 13.9.4.0.0 before 13.9.4.2.1
OracleNosql Database
before 19.3.12
NetappActive Iq Unified Manager
from 7.3
from 9.5

Weakness classification

CWE-20

References