NetSight
IP …
critical9.8

CVE-2018-19361

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic …

Impact

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
from 2.6.0 through 2.6.7.2
from 2.7.0 before 2.7.9.5
from 2.8.0 before 2.8.11.3
from 2.9.0 before 2.9.8
DebianDebian Linux
Versions 8.0, 9.0
OracleBusiness Process Management Suite
Versions 12.1.3.0.0, 12.2.1.3.0
OraclePrimavera P6 Enterprise Project Portfolio Management
from 17.7 through 17.12
Versions 15.1, 15.2, 16.1, 16.2, 18.8
OraclePrimavera Unifier
from 17.7 through 17.12
Versions 16.1, 16.2, 18.8
OracleRetail Workforce Management Software
Version 1.60.9.0.0
OracleWebcenter Portal
Version 12.2.1.3.0
RedhatAutomation Manager
Version 7.3.1
RedhatDecision Manager
Version 7.3.1
RedhatJboss Bpm Suite
Version 6.4.11
RedhatJboss Brms
Version 6.4.10
RedhatOpenshift Container Platform
Version 3.11

Weakness classification

CWE-502

References