NetSight
IP …
critical9.8

CVE-2018-14720

XML External Entity Reference (XXE) in jackson-databind

Impact

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.

Affected packages

EcosystemPackageAffectedFixed in
mavencom.fasterxml.jackson.core:jackson-databind>= 2.9.0, < 2.9.72.9.7

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
from 2.6.0 before 2.6.7.2
from 2.7.0 before 2.7.9.5
from 2.8.0 before 2.8.11.3
from 2.9.0 before 2.9.7
Versions 2.7.0, 2.8.0
DebianDebian Linux
Versions 8.0, 9.0
OracleBanking Platform
Versions 2.5.0, 2.6.0, 2.6.1, 2.6.2
OracleCommunications Billing And Revenue Management
Versions 7.5, 12.0
OracleEnterprise Manager For Virtualization
Versions 13.2.2, 13.2.3, 13.3.1
OracleFinancial Services Analytical Applications Infrastructure
Versions 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7
OracleJdeveloper
Versions 12.1.3.0.0, 12.2.1.3.0
OraclePrimavera Unifier
from 17.1 through 17.12
Versions 16.1, 16.2, 18.8
OracleRetail Merchandising System
Versions 15.0, 16.0
OracleWebcenter Portal
Version 12.2.1.3.0
RedhatJboss Enterprise Application Platform
Version 7.2.0
RedhatOpenshift Container Platform
Version 3.11

Weakness classification

CWE-502CWE-611

References