vulnwire
8.1high

CVE-2018-5968

Deserialization of Untrusted Data in jackson-databind

Also known as GHSA-w3f4-3q6j-rh82

Published 8 y ago · modified 30 d ago · JSON

CVSS
8.1
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
7.2%
percentile 94%
Public exploits
0
none known

FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.

CISA SSVC assessment

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
30 d ago

Exploit prediction (EPSS)

7.25% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.18.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.06.8AV:N/AC:M/Au:N/C:P/I:P/A:P
GitHub3.18.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
mavencom.fasterxml.jackson.core:jackson-databind
>=2.8.0, <2.8.11.1
>=2.9.0, <2.9.4
<2.7.9.5
2.8.11.1
2.9.4
2.7.9.5

Classification

Weakness
  • CWE-184 Incomplete List of Disallowed Inputs
  • CWE-502 Deserialization of Untrusted Data

References

  • access.redhat.com /errata/RHSA-2018:0479 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:0481 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:1525 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:0480 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • debian.org /security/2018/dsa-4114 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • access.redhat.com /errata/RHSA-2018:0478 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2019:2858 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2019:3149 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • oracle.com /security-alerts/cpuoct2020.html · x_refsource_MISC, x_transferred
  • support.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us · x_refsource_CONFIRM, x_transferred
  • security.netapp.com /advisory/ntap-20180423-0002/ · x_refsource_CONFIRM, x_transferred
  • github.com /FasterXML/jackson-databind/issues/1899 · x_refsource_MISC, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2018-5968 · advisory
  • github.com /GulajavaMinistudio/jackson-databind/pull/92/commits/038b471e2efde2e8f96b4e0be958d3e5a1ff1 · web
  • github.com /FasterXML/jackson-databind/commit/454be8bb8c913be18298327a84ca45a280b61605 · web
  • github.com /FasterXML/jackson-databind/commit/038b471e2efde2e8f96b4e0be958d3e5a1ff1d0 · web
  • github.com /FasterXML/jackson-databind/commit/03ea0bec6293d4330b5ad19d1d62aca0e3cb6381 · web
  • security.netapp.com /advisory/ntap-20180423-0002 · web
  • github.com /FasterXML/jackson-databind · package

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.