NetSight
IP …
critical9.8

CVE-2018-19360

Deserialization of Untrusted Data in jackson-databind due to polymorphic deserialization

Impact

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.

Affected packages

EcosystemPackageAffectedFixed in
mavencom.fasterxml.jackson.core:jackson-databind>= 2.9.0, < 2.9.82.9.8

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
from 2.6.0 through 2.6.7.2
from 2.7.0 before 2.7.9.5
from 2.8.0 before 2.8.11.3
from 2.9.0 before 2.9.8
DebianDebian Linux
Version 8.0
OracleBusiness Process Management Suite
Versions 12.1.3.0.0, 12.2.1.3.0
OraclePrimavera P6 Enterprise Project Portfolio Management
from 17.7 through 17.12
Versions 15.1, 15.2, 16.1, 16.2, 18.8
OraclePrimavera Unifier
from 17.7 through 17.12
Versions 16.1, 16.2, 18.8
OracleRetail Workforce Management Software
Version 1.60.9.0.0
OracleWebcenter Portal
Version 12.2.1.3.0
RedhatAutomation Manager
Version 7.3.1
RedhatDecision Manager
Version 7.3.1
RedhatJboss Bpm Suite
Version 6.4.11
RedhatJboss Brms
Version 6.4.10
RedhatOpenshift Container Platform
Version 3.11

Weakness classification

CWE-502

References