CVE-2018-7489
Critical
Description
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Fasterxml Jackson-databind
PublishedFeb 26, 2018
First seenFeb 26, 2018
How to fix
Update
- fasterxml jackson-databind2.7.9.3, 2.8.11.1, 2.9.5 or later
- com.fasterxml.jackson.core:jackson-databind2.8.11.1, 2.9.5, 2.7.9.3, 2.6.7.5 or later
Vendor advisories
- access.redhat.com/errata/RHSA-2018:1448
- access.redhat.com/errata/RHSA-2018:1449
- access.redhat.com/errata/RHSA-2018:2938
- access.redhat.com/errata/RHSA-2018:1450
- access.redhat.com/errata/RHSA-2018:2090
- access.redhat.com/errata/RHSA-2018:2939
- access.redhat.com/errata/RHSA-2018:1786
- access.redhat.com/errata/RHSA-2018:1451
- debian.org/security/2018/dsa-4190
- access.redhat.com/errata/RHSA-2018:1447
- access.redhat.com/errata/RHSA-2018:2088
- access.redhat.com/errata/RHSA-2018:2089
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fasterxml jackson-databind | v < 2.7.9.3, 2.8.0 ≤ v < 2.8.11.1, 2.9.0 ≤ v < 2.9.5 | 2.7.9.3, 2.8.11.1, 2.9.5 |
| debian debian_linux | 8.0, 9.0 | — |
| oracle communications_billing_and_revenue_management | 7.5, 12.0 | — |
| oracle communications_instant_messaging_server | 10.0.1 | — |
| redhat jboss_enterprise_application_platform | 6.4.19, 7.1.2 | — |
| com.fasterxml.jackson.core:jackson-databindMaven | 2.8.0 ≤ v < 2.8.11.1, 2.9.0 ≤ v < 2.9.5, 2.7.0 ≤ v < 2.7.9.3, v < 2.6.7.5 | 2.8.11.1, 2.9.5, 2.7.9.3, 2.6.7.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.