An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
AND |
|
Configuration 4 (hide)
|
History
03 Apr 2024, 17:40
Type | Values Removed | Values Added |
---|---|---|
References | () https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - Mailing List, Third Party Advisory | |
References | () https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d%40%3Cissues.lucene.apache.org%3E - Mailing List, Third Party Advisory | |
References | () https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - Mailing List, Third Party Advisory | |
References | () https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - Mailing List, Third Party Advisory | |
References | () https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - Third Party Advisory |
07 Nov 2023, 02:51
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
08 Jun 2023, 17:56
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - Patch, Third Party Advisory |
22 Feb 2021, 21:47
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:o:redhat:enterprise_linux:7.6:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:* |
cpe:2.3:a:oracle:clusterware:12.1.0.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:utilities_advanced_spatial_and_operational_analytics:2.7.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.2.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* |
References | (MISC) https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - Third Party Advisory | |
References | (MISC) https://www.oracle.com/security-alerts/cpuoct2020.html - Third Party Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E - Mailing List, Third Party Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:2804 - Third Party Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:4037 - Third Party Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:2858 - Third Party Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:1823 - Third Party Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:3140 - Third Party Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d@%3Cissues.lucene.apache.org%3E - Mailing List, Third Party Advisory | |
References | (N/A) https://www.oracle.com/security-alerts/cpuapr2020.html - Third Party Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:1822 - Third Party Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E - Mailing List, Third Party Advisory | |
References | (MISC) https://www.oracle.com/security-alerts/cpujan2020.html - Third Party Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E - Mailing List, Third Party Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:3149 - Third Party Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:3892 - Third Party Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:3002 - Third Party Advisory |
Information
Published : 2019-07-09 16:15
Updated : 2024-04-03 17:40
NVD link : CVE-2018-11307
Mitre link : CVE-2018-11307
CVE.ORG link : CVE-2018-11307
JSON object : View
Products Affected
redhat
- enterprise_linux
- openshift_container_platform
oracle
- utilities_advanced_spatial_and_operational_analytics
- clusterware
- global_lifecycle_management_opatch
- communications_instant_messaging_server
- retail_customer_management_and_segmentation_foundation
fasterxml
- jackson-databind
CWE
CWE-502
Deserialization of Untrusted Data