Deserialization of untrusted data in jackson-databind - CVE-2018-5968

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU10610

Deserialization of untrusted data in jackson-databind - CVE-2018-5968

Published: February 16, 2018


Vulnerability identifier: #VU10610
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-5968
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code.

The weakness exists due to deserialization flaw. A remote attacker can supply specially crafted input, execute arbitrary code and bypass a blacklist on the target system.

Successful exploitation of the vulnerability may result in system compromise.

Affected software

jackson-databind
Debian Linux
Fedora
z/Transaction Processing Facility ( z/TPF)
IBM Business Process Manager
IBM Business Automation Workflow
IBM Cloud Application Performance Management (APM)
Cloudera Observability with IBM
Dell Support Assist Enterprise
StreamSets Data Collector
Storage Virtualize
Red Hat OpenShift Container Platform
Red Hat Virtualization
Red Hat Virtualization Host
watsonx.data
jackson-databind
eap7-jboss-ec2-eap (Red Hat package)

How to mitigate CVE-2018-5968

Update to version 2.8.11.1 or 2.9.4.

Cloudera Observability with IBM - update to 3.6.2
Dell Support Assist Enterprise - update to 4.00.06.00
IBM Business Automation Workflow - update to 18.0.0.1
watsonx.data - update to 2.0.3
jackson-databind - addressed in versions 2.7.6-8.fc26, 2.7.6-8.fc27
StreamSets Data Collector - update to 7.0.0
eap7-jboss-ec2-eap (Red Hat package) - addressed in versions 7.1.1-3.1.GA_redhat_3.ep7.el6, 7.1.1-3.1.GA_redhat_3.ep7.el7
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
Storage Virtualize - addressed in versions 8.6.3.0, 8.7.0.0

External References

Related Security Bulletins