CVE-2018-19361
Critical
Description
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Fasterxml Jackson-databind
PublishedJan 2, 2019
First seenJan 2, 2019
How to fix
Update
- fasterxml jackson-databind2.7.9.5, 2.8.11.3, 2.9.8 or later
- com.fasterxml.jackson.core:jackson-databind2.7.9.5, 2.9.8, 2.8.11.3 or later
Vendor advisories
- access.redhat.com/errata/RHSA-2019:0782
- access.redhat.com/errata/RHSA-2019:0877
- access.redhat.com/errata/RHBA-2019:0959
- debian.org/security/2019/dsa-4452
- access.redhat.com/errata/RHSA-2019:1782
- access.redhat.com/errata/RHSA-2019:1797
- access.redhat.com/errata/RHSA-2019:1822
- access.redhat.com/errata/RHSA-2019:1823
- access.redhat.com/errata/RHSA-2019:2804
- access.redhat.com/errata/RHSA-2019:2858
- access.redhat.com/errata/RHSA-2019:3002
- access.redhat.com/errata/RHSA-2019:3140
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fasterxml jackson-databind | 2.6.0 ≤ v ≤ 2.6.7.2, 2.7.0 ≤ v < 2.7.9.5, 2.8.0 ≤ v < 2.8.11.3, 2.9.0 ≤ v < 2.9.8 | 2.7.9.5, 2.8.11.3, 2.9.8 |
| debian debian_linux | 8.0, 9.0 | — |
| oracle business_process_management_suite | 12.1.3.0.0, 12.2.1.3.0 | — |
| oracle primavera_p6_enterprise_project_portfolio_management | 17.7 ≤ v ≤ 17.12, 15.1, 15.2, 16.1, 16.2, 18.8 | — |
| oracle primavera_unifier | 17.7 ≤ v ≤ 17.12, 16.1, 16.2, 18.8 | — |
| oracle retail_workforce_management_software | 1.60.9.0.0 | — |
| oracle webcenter_portal | 12.2.1.3.0 | — |
| redhat automation_manager | 7.3.1 | — |
| redhat decision_manager | 7.3.1 | — |
| redhat jboss_bpm_suite | 6.4.11 | — |
| redhat jboss_brms | 6.4.10 | — |
| redhat openshift_container_platform | 3.11 | — |
| com.fasterxml.jackson.core:jackson-databindMaven | 2.7.0 ≤ v < 2.7.9.5, 2.9.0 ≤ v < 2.9.8, 2.8.0 ≤ v < 2.8.11.3 | 2.7.9.5, 2.9.8, 2.8.11.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.