תיאור (מקור, אנגלית)
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
מוצרים מושפעים
fasterxml: jackson-databind; debian: debian linux; redhat: openshift container platform; redhat: satellite; redhat: satellite capsule; redhat: enterprise linux; redhat: jboss enterprise application platform; netapp: oncommand balance; netapp: oncommand performance manager; netapp: oncommand shift; netapp: snapcenter; oracle: banking platform; oracle: clusterware; oracle: communications billing and revenue management; oracle: communications diameter signaling router
קישורים10
- www.oracle.com/technetwork/security-advisory/cpuapr2018-367806… PatchThird Party Advisory
- www.oracle.com/technetwork/security-advisory/cpujul2018-425824… PatchThird Party Advisory
- www.oracle.com/technetwork/security-advisory/cpuoct2018-442829… PatchThird Party Advisory
- github.com/FasterXML/jackson-databind/issues/1737 Issue TrackingPatchThird Party Advisory
- www.oracle.com/technetwork/security-advisory/cpujan2019-507280… PatchThird Party Advisory
- www.oracle.com/technetwork/security-advisory/cpujul2019-507283… PatchThird Party Advisory
- www.oracle.com/technetwork/security-advisory/cpuapr2018-367806… PatchThird Party Advisory
- www.oracle.com/technetwork/security-advisory/cpujul2018-425824… PatchThird Party Advisory
- www.oracle.com/technetwork/security-advisory/cpuoct2018-442829… PatchThird Party Advisory
- github.com/FasterXML/jackson-databind/issues/1737 Issue TrackingPatchThird Party Advisory
מדדים
- CVSS 3.1
-
9.8
CRITICAL
מקור הציון: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — סבירות ניצול
- 8% אחוזון 95 · נכון ל-3 בנובמבר 2026
- CWE
- CWE-184CWE-502
האם אפשר לנצל את הפגיעות הזו אצלכם?
עדכון אבטחה סוגר את הפרצה הידועה. בדיקת חדירות מראה לאן תוקף עדיין יכול להגיע — עם הוכחה.