NetSight
IP …
critical9.8

CVE-2018-11307

Deserialization of Untrusted Data in jackson-databind

Impact

An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.

Affected packages

EcosystemPackageAffectedFixed in
mavencom.fasterxml.jackson.core:jackson-databind>= 2.9.0, < 2.9.62.9.6

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
from 2.0.0 before 2.6.7.3
from 2.7.0 before 2.7.9.4
from 2.8.0 before 2.8.11.2
from 2.9.0 before 2.9.6
RedhatOpenshift Container Platform
Versions 3.11, 4.1
OracleClusterware
Version 12.1.0.2.0
OracleCommunications Instant Messaging Server
Version 10.0.1.2.0
OracleGlobal Lifecycle Management Opatch
before 11.2.0.3.23
from 12.2.0.1.0 before 12.2.0.1.19
from 13.9.4.0.0 before 13.9.4.2.1
OracleRetail Customer Management And Segmentation Foundation
Version 17.0
OracleUtilities Advanced Spatial And Operational Analytics
Version 2.7.0.1

Weakness classification

CWE-502

References