Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 3 rhel_software_collections:3::el7 | rh-maven35-jackson-databind | 0:2.7.6-2.5.el7 |
| Red Hat · RHEL 3 rhel_software_collections:3::el7 | rh-maven35-jackson-databind-javadoc | 0:2.7.6-2.5.el7 |
Vulnerabilities 10
-
Critical 10.0CVE-2018-14721 EPSS 10%
Server-Side Request Forgery (SSRF) in jackson-databind
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
-
Critical 9.8
Deserialization of Untrusted Data in jackson-databind
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
-
Critical 9.8CVE-2018-14718 EPSS 13%
Arbitrary Code Execution in jackson-databind
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
-
Critical 9.8
Arbitrary Code Execution in jackson-databind
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
-
Critical 9.8
XML External Entity Reference (XXE) in jackson-databind
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
-
Critical 9.8CVE-2018-19360 EPSS 11%
Deserialization of Untrusted Data in jackson-databind due to polymorphic deserialization
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
-
Critical 9.8CVE-2018-19361 EPSS 11%
Deserialization of Untrusted Data in jackson-databind
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
-
Critical 9.8CVE-2018-19362 EPSS 11%
com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
-
High 7.5
jackson-databind Deserialization of Untrusted Data vulnerability
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the class…
-
High 7.5
Deserialization of Untrusted Data
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1666415
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1666418
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1666423
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1666428
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1666482
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1666484
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1666489
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1671096
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1671097
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1677341
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0782.json
-
report
https://access.redhat.com/security/cve/CVE-2018-11307
-
advisory
https://www.cve.org/CVERecord?id=CVE-2018-11307
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-11307
-
report
https://access.redhat.com/security/cve/CVE-2018-12022
-
advisory
https://www.cve.org/CVERecord?id=CVE-2018-12022
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-12022
-
report
https://access.redhat.com/security/cve/CVE-2018-12023
-
advisory
https://www.cve.org/CVERecord?id=CVE-2018-12023
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-12023
-
report
https://access.redhat.com/security/cve/CVE-2018-14718
-
advisory
https://www.cve.org/CVERecord?id=CVE-2018-14718
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-14718
-
report
https://access.redhat.com/security/cve/CVE-2018-14719
-
advisory
https://www.cve.org/CVERecord?id=CVE-2018-14719
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-14719
-
report
https://access.redhat.com/security/cve/CVE-2018-14720
-
advisory
https://www.cve.org/CVERecord?id=CVE-2018-14720
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-14720
-
report
https://access.redhat.com/security/cve/CVE-2018-14721
-
advisory
https://www.cve.org/CVERecord?id=CVE-2018-14721
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-14721
-
report
https://access.redhat.com/security/cve/CVE-2018-19360
-
advisory
https://www.cve.org/CVERecord?id=CVE-2018-19360
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-19360
-
report
https://access.redhat.com/security/cve/CVE-2018-19361
-
advisory
https://www.cve.org/CVERecord?id=CVE-2018-19361
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-19361