vulnwire
9.8crit

CVE-2018-7489in critical feed

FasterXML jackson-databind allows unauthenticated remote code execution

Also known as GHSA-cggj-fvv3-cqwv

Published 8 y ago · modified 22 d ago · JSON

CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
19.8%
percentile 97%
Public exploits
0
none known

FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.

CISA SSVC assessment

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
22 d ago

Exploit prediction (EPSS)

19.78% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
mavencom.fasterxml.jackson.core:jackson-databind
>=2.8.0, <2.8.11.1
>=2.9.0, <2.9.5
>=2.7.0, <2.7.9.3
<2.6.7.5
2.8.11.1
2.9.5
2.7.9.3
2.6.7.5

Classification

Weakness
  • CWE-184 Incomplete List of Disallowed Inputs
  • CWE-502 Deserialization of Untrusted Data

References

  • securityfocus.com /bid/103203 · vdb-entry, x_refsource_BID, x_transferred
  • access.redhat.com /errata/RHSA-2018:1448 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:1449 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:2938 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:1450 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:2090 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:2939 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • securitytracker.com /id/1041890 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • securitytracker.com /id/1040693 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • access.redhat.com /errata/RHSA-2018:1786 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:1451 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • debian.org /security/2018/dsa-4190 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • access.redhat.com /errata/RHSA-2018:1447 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:2088 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:2089 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2019:2858 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2019:3149 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • oracle.com /technetwork/security-advisory/cpujul2018-4258247.html · x_refsource_CONFIRM, x_transferred
  • oracle.com /technetwork/security-advisory/cpuapr2018-3678067.html · x_refsource_CONFIRM, x_transferred
  • oracle.com /technetwork/security-advisory/cpuoct2018-4428296.html · x_refsource_CONFIRM, x_transferred
  • oracle.com /technetwork/security-advisory/cpujan2019-5072801.html · x_refsource_CONFIRM, x_transferred
  • oracle.com /technetwork/security-advisory/cpuapr2019-5072813.html · x_refsource_MISC, x_transferred
  • oracle.com /technetwork/security-advisory/cpujul2019-5072835.html · x_refsource_MISC, x_transferred
  • oracle.com /security-alerts/cpuoct2020.html · x_refsource_MISC, x_transferred
  • support.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us · x_refsource_CONFIRM, x_transferred
  • security.netapp.com /advisory/ntap-20180328-0001/ · x_refsource_CONFIRM, x_transferred
  • github.com /FasterXML/jackson-databind/issues/1931 · x_refsource_CONFIRM, x_transferred
  • lists.apache.org /thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid. · mailing-list, x_refsource_MLIST, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2018-7489 · advisory
  • github.com /FasterXML/jackson-databind/commit/e66c0a9d3c926ff1b63bf586c824ead1d02f2a3d · web
  • github.com /FasterXML/jackson-databind/commit/ca2bfc86af82a1479112004b663ba74c760752e6 · web
  • github.com /FasterXML/jackson-databind/commit/c921f0935d5e41bf206e702d8077a275ba1a6efc · web
  • github.com /FasterXML/jackson-databind/commit/6799f8f10cc78e9af6d443ed6982d00a13f2e7d2 · web
  • github.com /FasterXML/jackson-databind/commit/bc22f90eb7f896ace9567598a99cb1ff6e0f9d9d · web
  • security.netapp.com /advisory/ntap-20180328-0001 · web
  • lists.apache.org /thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1@%3Ccommits.druid.ap · web
  • github.com /advisories/GHSA-cggj-fvv3-cqwv · advisory
  • github.com /FasterXML/jackson-databind · package

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.