CVE-2018-5968
High
Description
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.
SeverityHigh
CVSS8.1
Exploit probability—
Product
Fasterxml Jackson-databind
PublishedJan 22, 2018
First seenJan 22, 2018
How to fix
Update
- fasterxml jackson-databind2.6.7.3, 2.7.9.2, 2.8.11.1, 2.9.4 or later
- com.fasterxml.jackson.core:jackson-databind2.8.11.1, 2.9.4, 2.7.9.5 or later
Vendor advisories
- access.redhat.com/errata/RHSA-2018:0479
- access.redhat.com/errata/RHSA-2018:0481
- access.redhat.com/errata/RHSA-2018:1525
- access.redhat.com/errata/RHSA-2018:0480
- debian.org/security/2018/dsa-4114
- access.redhat.com/errata/RHSA-2018:0478
- access.redhat.com/errata/RHSA-2019:2858
- access.redhat.com/errata/RHSA-2019:3149
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fasterxml jackson-databind | 2.0.0 ≤ v < 2.6.7.3, 2.7.0 ≤ v < 2.7.9.2, 2.8.0 ≤ v < 2.8.11.1, 2.9.0 ≤ v < 2.9.4 | 2.6.7.3, 2.7.9.2, 2.8.11.1, 2.9.4 |
| debian debian_linux | 8.0, 9.0 | — |
| redhat openshift_container_platform | 4.1, 3.11 | — |
| redhat virtualization | 4.0 | — |
| redhat virtualization_host | 4.0 | — |
| redhat jboss_enterprise_application_platform | 7.1 | — |
| netapp e-series_santricity_os_controller | 11.0.0 ≤ v ≤ 11.60.3 | — |
| netapp e-series_santricity_web_services_proxy | No range specified | — |
| netapp oncommand_shift | No range specified | — |
| com.fasterxml.jackson.core:jackson-databindMaven | 2.8.0 ≤ v < 2.8.11.1, 2.9.0 ≤ v < 2.9.4, v < 2.7.9.5 | 2.8.11.1, 2.9.4, 2.7.9.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.