CVE-2018-14718
Critical
Description
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Fasterxml Jackson-databind
PublishedJan 2, 2019
First seenJan 2, 2019
How to fix
Update
- fasterxml jackson-databind2.6.7.3, 2.7.9.5, 2.8.11.3, 2.9.7 or later
- oracle global_lifecycle_management_opatch11.2.0.3.23, 12.2.0.1.19, 13.9.4.2.1 or later
- oracle nosql_database19.3.12 or later
- redhat openshift_container_platform3.11.153, 4.6.26, 4.1.18 or later
- com.fasterxml.jackson.core:jackson-databind2.9.7, 2.8.11.3, 2.7.9.5, 2.6.7.3 or later
Vendor advisories
- access.redhat.com/errata/RHSA-2019:0782
- access.redhat.com/errata/RHSA-2019:0877
- access.redhat.com/errata/RHBA-2019:0959
- debian.org/security/2019/dsa-4452
- access.redhat.com/errata/RHSA-2019:1782
- access.redhat.com/errata/RHSA-2019:1797
- access.redhat.com/errata/RHSA-2019:1822
- access.redhat.com/errata/RHSA-2019:1823
- access.redhat.com/errata/RHSA-2019:2804
- access.redhat.com/errata/RHSA-2019:2858
- access.redhat.com/errata/RHSA-2019:3002
- access.redhat.com/errata/RHSA-2019:3140
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fasterxml jackson-databind | 2.0.0 ≤ v < 2.6.7.3, 2.7.0 ≤ v < 2.7.9.5, 2.8.0 ≤ v < 2.8.11.3, 2.9.0 ≤ v < 2.9.7 | 2.6.7.3, 2.7.9.5, 2.8.11.3, 2.9.7 |
| debian debian_linux | 8.0, 9.0 | — |
| oracle banking_platform | 2.5.0, 2.6.0, 2.6.1, 2.6.2 | — |
| oracle business_process_management_suite | 12.1.3.0.0, 12.2.1.3.0 | — |
| oracle communications_billing_and_revenue_management | 7.5, 12.0 | — |
| oracle communications_instant_messaging_server | 10.0.1.3.0 | — |
| oracle enterprise_manager_for_virtualization | 13.2.2, 13.2.3, 13.3.1 | — |
| oracle financial_services_analytical_applications_infrastructure | 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7 | — |
| oracle global_lifecycle_management_opatch | v < 11.2.0.3.23, 12.2.0.1.0 ≤ v < 12.2.0.1.19, 13.9.4.0.0 ≤ v < 13.9.4.2.1 | 11.2.0.3.23, 12.2.0.1.19, 13.9.4.2.1 |
| oracle jd_edwards_enterpriseone_orchestrator | 9.2 | — |
| oracle jd_edwards_enterpriseone_tools | 9.2 | — |
| oracle jdeveloper | 12.1.3.0.0, 12.2.1.3.0 | — |
| oracle nosql_database | v < 19.3.12, 19.3.12 | 19.3.12 |
| oracle primavera_p6_enterprise_project_portfolio_management | 17.7 ≤ v ≤ 17.12, 15.1, 15.2, 16.1, 16.2, 18.8 | — |
| oracle primavera_unifier | 17.7 ≤ v ≤ 17.12, 16.1, 16.2, 18.8 | — |
| oracle retail_customer_management_and_segmentation_foundation | 17.0 | — |
| oracle retail_merchandising_system | 15.0, 16.0 | — |
| oracle retail_workforce_management_software | 1.60.9.0.0 | — |
| oracle siebel_engineering_-_installer_\&_deployment | v ≤ 19.8 | — |
| oracle siebel_ui_framework | v ≤ 19.10 | — |
| oracle webcenter_portal | 12.2.1.3.0 | — |
| netapp oncommand_workflow_automation | No range specified | — |
| netapp snapcenter | No range specified | — |
| netapp steelstore_cloud_integrated_storage | No range specified | — |
| redhat openshift_container_platform | 3.11 ≤ v < 3.11.153, 4.6 ≤ v < 4.6.26, 3.10, 4.1 ≤ v < 4.1.18 | 3.11.153, 4.6.26, 4.1.18 |
| com.fasterxml.jackson.core:jackson-databindMaven | 2.9.0 ≤ v < 2.9.7, 2.8.0 ≤ v < 2.8.11.3, 2.7.0 ≤ v < 2.7.9.5, 2.0.0 ≤ v < 2.6.7.3 | 2.9.7, 2.8.11.3, 2.7.9.5, 2.6.7.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.