NetSight
IP …
critical9.8

CVE-2018-7489

FasterXML jackson-databind allows unauthenticated remote code execution

Impact

FasterXML jackson-databind before before 2.6.7.5, 2.7.x before 2.7.9.3, 2.8.x before 2.8.11.1, and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.

Affected packages

EcosystemPackageAffectedFixed in
mavencom.fasterxml.jackson.core:jackson-databind>= 2.9.0, < 2.9.52.9.5

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
before 2.7.9.3
from 2.8.0 before 2.8.11.1
from 2.9.0 before 2.9.5
DebianDebian Linux
Versions 8.0, 9.0
OracleCommunications Billing And Revenue Management
Versions 7.5, 12.0
OracleCommunications Instant Messaging Server
Version 10.0.1
RedhatJboss Enterprise Application Platform
Versions 6.4.19, 7.1.2

Weakness classification

CWE-184CWE-502

References