CVE-2018-7489
טרם דורגה
תיאור (מקור, אנגלית)
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.
מדדים
- EPSS — סבירות ניצול
- 20% (אחוזון 100) נכון ל-20/10/2026
- CWE
- CWE-184, CWE-502
מוצרים מושפעים
fasterxml: jackson-databind; debian: debian linux; oracle: communications billing and revenue management; oracle: communications instant messaging server; redhat: jboss enterprise application platform
קישורים
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html Patch
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html Patch
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html PatchThird Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html PatchThird Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html Patch
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html Patch
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html PatchThird Party Advisory