CVE-2018-11307
Critical
Description
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Fasterxml Jackson-databind
PublishedJul 9, 2019
First seenJul 9, 2019
How to fix
Update
- fasterxml jackson-databind2.6.7.3, 2.7.9.4, 2.8.11.2, 2.9.6 or later
- oracle global_lifecycle_management_opatch11.2.0.3.23, 12.2.0.1.19, 13.9.4.2.1 or later
- com.fasterxml.jackson.core:jackson-databind2.7.9.4, 2.8.11.2, 2.9.6 or later
Vendor advisories
- access.redhat.com/errata/RHSA-2019:1822
- access.redhat.com/errata/RHSA-2019:1823
- access.redhat.com/errata/RHSA-2019:2804
- access.redhat.com/errata/RHSA-2019:2858
- access.redhat.com/errata/RHSA-2019:3002
- access.redhat.com/errata/RHSA-2019:3140
- access.redhat.com/errata/RHSA-2019:3149
- access.redhat.com/errata/RHSA-2019:3892
- access.redhat.com/errata/RHSA-2019:4037
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fasterxml jackson-databind | 2.0.0 ≤ v < 2.6.7.3, 2.7.0 ≤ v < 2.7.9.4, 2.8.0 ≤ v < 2.8.11.2, 2.9.0 ≤ v < 2.9.6 | 2.6.7.3, 2.7.9.4, 2.8.11.2, 2.9.6 |
| redhat openshift_container_platform | 3.11, 4.1 | — |
| oracle clusterware | 12.1.0.2.0 | — |
| oracle communications_instant_messaging_server | 10.0.1.2.0 | — |
| oracle global_lifecycle_management_opatch | v < 11.2.0.3.23, 12.2.0.1.0 ≤ v < 12.2.0.1.19, 13.9.4.0.0 ≤ v < 13.9.4.2.1 | 11.2.0.3.23, 12.2.0.1.19, 13.9.4.2.1 |
| oracle retail_customer_management_and_segmentation_foundation | 17.0 | — |
| oracle utilities_advanced_spatial_and_operational_analytics | 2.7.0.1 | — |
| com.fasterxml.jackson.core:jackson-databindMaven | 2.0.0 ≤ v < 2.7.9.4, 2.8.0 ≤ v < 2.8.11.2, 2.9.0 ≤ v < 2.9.6 | 2.7.9.4, 2.8.11.2, 2.9.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.