CVE-2018-11307

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2018-11307
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://access.redhat.com/errata/RHSA-2019:0782 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1822 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1823 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2804 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2858 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3002 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3140 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3149 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3892 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4037 Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2032 Third Party Advisory
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E Mailing List Third Party Advisory
https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d%40%3Cissues.lucene.apache.org%3E Mailing List Third Party Advisory
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E Mailing List Third Party Advisory
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E Mailing List Third Party Advisory
https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 Third Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-7525 Third Party Advisory US Government Resource
https://www.oracle.com/security-alerts/cpuapr2020.html Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0782 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1822 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1823 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2804 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2858 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3002 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3140 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3149 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3892 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4037 Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2032 Third Party Advisory
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E Mailing List Third Party Advisory
https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d%40%3Cissues.lucene.apache.org%3E Mailing List Third Party Advisory
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E Mailing List Third Party Advisory
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E Mailing List Third Party Advisory
https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 Third Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-7525 Third Party Advisory US Government Resource
https://www.oracle.com/security-alerts/cpuapr2020.html Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:a:oracle:clusterware:12.1.0.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:utilities_advanced_spatial_and_operational_analytics:2.7.0.1:*:*:*:*:*:*:*
History

21 Nov 2024, 03:43

Type Values Removed Values Added
References () https://access.redhat.com/errata/RHSA-2019:0782 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:0782 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2019:1822 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:1822 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2019:1823 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:1823 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2019:2804 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:2804 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2019:2858 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:2858 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2019:3002 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:3002 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2019:3140 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:3140 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2019:3149 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:3149 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2019:3892 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:3892 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2019:4037 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:4037 - Third Party Advisory
References () https://github.com/FasterXML/jackson-databind/issues/2032 - Third Party Advisory () https://github.com/FasterXML/jackson-databind/issues/2032 - Third Party Advisory
References () https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - Mailing List, Third Party Advisory () https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - Mailing List, Third Party Advisory
References () https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d%40%3Cissues.lucene.apache.org%3E - Mailing List, Third Party Advisory () https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d%40%3Cissues.lucene.apache.org%3E - Mailing List, Third Party Advisory
References () https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - Mailing List, Third Party Advisory () https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - Mailing List, Third Party Advisory
References () https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - Mailing List, Third Party Advisory () https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - Mailing List, Third Party Advisory
References () https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - Third Party Advisory () https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - Third Party Advisory
References () https://nvd.nist.gov/vuln/detail/CVE-2017-7525 - Third Party Advisory, US Government Resource () https://nvd.nist.gov/vuln/detail/CVE-2017-7525 - Third Party Advisory, US Government Resource
References () https://www.oracle.com/security-alerts/cpuapr2020.html - Third Party Advisory () https://www.oracle.com/security-alerts/cpuapr2020.html - Third Party Advisory
References () https://www.oracle.com/security-alerts/cpujan2020.html - Third Party Advisory () https://www.oracle.com/security-alerts/cpujan2020.html - Third Party Advisory
References () https://www.oracle.com/security-alerts/cpuoct2020.html - Third Party Advisory () https://www.oracle.com/security-alerts/cpuoct2020.html - Third Party Advisory
References () https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - Patch, Third Party Advisory () https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - Patch, Third Party Advisory

03 Apr 2024, 17:40

Type Values Removed Values Added
References () https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - () https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - Mailing List, Third Party Advisory
References () https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d%40%3Cissues.lucene.apache.org%3E - () https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d%40%3Cissues.lucene.apache.org%3E - Mailing List, Third Party Advisory
References () https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - () https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - Mailing List, Third Party Advisory
References () https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - () https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - Mailing List, Third Party Advisory
References () https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - () https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - Third Party Advisory

08 Jun 2023, 17:56

Type Values Removed Values Added
References (MISC) https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - Third Party Advisory (MISC) https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - Patch, Third Party Advisory
Information

Published : 2019-07-09 16:15

Updated : 2024-11-21 03:43

NVD link : CVE-2018-11307

Mitre link : CVE-2018-11307

CVE.ORG link : CVE-2018-11307

JSON object : View

Products Affected

fasterxml

  • jackson-databind

oracle

  • communications_instant_messaging_server
  • clusterware
  • retail_customer_management_and_segmentation_foundation
  • utilities_advanced_spatial_and_operational_analytics
  • global_lifecycle_management_opatch

redhat

  • openshift_container_platform
  • enterprise_linux
CWE
CWE-502

Deserialization of Untrusted Data