Red Hat Enhancement Advisory: rhvm-appliance enhancement update

Fixed packages 1

Vulnerabilities 1

• Critical 9.8
  CVE-2018-7489 Public exploit EPSS 20%

  FasterXML jackson-databind allows unauthenticated remote code execution

  FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JS…

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Feb 26, 2018

References

• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1582507
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhea-2018_2082.json
• report
  https://access.redhat.com/security/cve/CVE-2018-7489
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1549276
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-7489
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-7489
• article
  https://access.redhat.com/solutions/3442891