Remote code execution in Primavera Unifier - CVE-2018-14718

Vulnerability identifier: #VU17053

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2018-14718

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
Primavera Unifier
Red Hat OpenShift Container Platform
Enterprise Manager for Virtualization
IBM Disconnected Log Collector
z/Transaction Processing Facility ( z/TPF)
Log Analysis
IBM Process Mining
OpenShift Logging
JBoss A-MQ
IBM Cloud Application Performance Management (APM)
IBM Security Verify Governance
Oracle Banking Platform
Cloudera Observability with IBM
Dell Support Assist Enterprise
Oracle Financial Services Analytical Applications Infrastructure
Integration Designer
B2B Advanced Communications
Multi-Enterprise Integration Gateway
Storage Virtualize
jackson-databind (Debian package)
bouncycastle
rh-maven35-jackson-databind (Red Hat package)
jackson-parent
jackson-datatypes-collections
jackson-jaxrs-providers
jackson-datatype-joda
jackson-datatype-jdk8
jackson-module-jsonSchema
jackson-dataformats-text
jackson-dataformats-binary
jackson-dataformat-xml
jackson-modules-base
jackson-databind
jackson-core
jackson-annotations
jackson-bom
eclipse-jgit
eclipse-linuxtools
Fuse
JBoss Data Virtualization
JBoss Data Grid
Oracle Communications Billing and Revenue Management
Oracle WebCenter Portal
Fedora
watsonx.data

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to the failure to block the slf4j-ext class from polymorphic deserialization. A remote attacker can execute arbitrary code with elevated privileges.

Install update from vendor's website.

• https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html#AppendixEM