NetSight
IP …
high7.5

CVE-2018-12022

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6.

Impact

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
from 2.0.0 before 2.6.7.3
from 2.7.0 before 2.7.9.4
from 2.8.0 before 2.8.11.2
from 2.9.0 before 2.9.6
DebianDebian Linux
Version 9.0
FedoraprojectFedora
Version 29
OracleJd Edwards Enterpriseone Tools
Version 9.2
OracleRetail Merchandising System
Version 15.0
RedhatAutomation Manager
Version 7.3.1
RedhatDecision Manager
Version 7.3.1
RedhatJboss Brms
Version 6.4.10
RedhatJboss Enterprise Application Platform
Version 7.2.0
RedhatOpenshift Container Platform
Version 3.11
RedhatSingle Sign-On
Version 7.3

Weakness classification

CWE-502

References