Server-Side Request Forgery (SSRF) in jackson-databind - CVE-2018-14721

Vulnerability identifier: #VU17776

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N]

CVE-ID: CVE-2018-14721

CWE-ID: CWE-918

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to fail to block the axis2-jaxws class from polymorphic deserialization. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

jackson-databind
API Manager
API Gateway
Fuse
z/Transaction Processing Facility ( z/TPF)
Log Analysis
IBM Process Mining
OpenShift Logging
IBM Sterling Partner Engagement Manager
IBM Cloud Application Performance Management (APM)
IBM Security Verify Governance
jackson-databind (Debian package)
bouncycastle
rh-maven35-jackson-databind (Red Hat package)
jackson-parent
jackson-dataformat-xml
jackson-dataformats-binary
jackson-databind
jackson-core
jackson-bom
jackson-dataformats-text
jackson-datatype-jdk8
jackson-datatype-joda
jackson-annotations
jackson-datatypes-collections
jackson-jaxrs-providers
jackson-module-jsonSchema
jackson-modules-base
eclipse-jgit
eclipse-linuxtools
Cloudera Observability with IBM
Dell Support Assist Enterprise
Integration Designer
Multi-Enterprise Integration Gateway
B2B Advanced Communications
Storage Virtualize
Red Hat OpenShift Container Platform
IBM Disconnected Log Collector
JBoss Data Grid
Fedora
watsonx.data
Red Hat Single Sign-On

Update to version 2.9.7.

jackson-databind - update to 2.9.7
API Manager - update to August 2022
API Gateway - update to August 2022
Log Analysis - addressed in versions 1.3.7.2 IF001, 1.3.7.2 IF002, 1.3.7.2 IF003
IBM Process Mining - update to 1.12.0.4
jackson-databind (Debian package) - update to 2.8.6-1+deb9u5
Cloudera Observability with IBM - update to 3.6.2
Red Hat OpenShift Container Platform - update to 4.6.26
Dell Support Assist Enterprise - update to 4.00.06.00
OpenShift Logging - update to 5.0.3
IBM Sterling Partner Engagement Manager - addressed in versions 6.2.3.5, 6.2.4.2
JBoss Data Grid - update to 7.3.2
Fuse - update to 7.5.0
Multi-Enterprise Integration Gateway - update to 1.0.0.8
B2B Advanced Communications - update to 1.0.0.8
IBM Disconnected Log Collector - update to 1.8.3
bouncycastle - update to 1.61-1.fc29
watsonx.data - addressed in versions 2.0.2, 2.0.3
rh-maven35-jackson-databind (Red Hat package) - update to 2.7.6-2.5.el7
jackson-parent - update to 2.9.1.2-1.fc29
jackson-dataformat-xml - update to 2.9.8-1.fc29
jackson-dataformats-binary - update to 2.9.8-1.fc29
jackson-databind - update to 2.9.8-1.fc29
jackson-core - update to 2.9.8-1.fc29
jackson-bom - update to 2.9.8-1.fc29
jackson-dataformats-text - update to 2.9.8-1.fc29
jackson-datatype-jdk8 - update to 2.9.8-1.fc29
jackson-datatype-joda - update to 2.9.8-1.fc29
jackson-annotations - update to 2.9.8-1.fc29
jackson-datatypes-collections - update to 2.9.8-1.fc29
jackson-jaxrs-providers - update to 2.9.8-1.fc29
jackson-module-jsonSchema - update to 2.9.8-1.fc29
jackson-modules-base - update to 2.9.8-1.fc29
eclipse-jgit - update to 5.2.0-4.fc29
eclipse-linuxtools - update to 7.1.0-3.fc29
Red Hat Single Sign-On - update to 7.3.1
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
Storage Virtualize - addressed in versions 8.6.3.0, 8.7.0.0
IBM Security Verify Governance - update to 10.0.1.0.4

• https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44
• https://github.com/FasterXML/jackson-databind/issues/2097
• https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7

• Multiple vulnerabilities in FasterXML jackson-databind
• Debian update for jackson-databind
• Red Hat update for OpenShift Container Platform 4.1.18 logging-elasticsearch5
• Red Hat update for OpenShift Container Platform logging-elasticsearch5-container
• Multiple vulnerabilities in Red Hat Fuse
• Multiple vulnerabilities in Red Hat Data Grid
• Multiple vulnerabilities in Red Hat OpenShift Container Platform
• Multiple vulnerabilities in Red Hat Openshift Logging
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in z/Transaction Processing Facility
• IBM Log Analysis update for FasterXML jackson-databind
• Red Hat Software Collections update for rh-maven35-jackson-databind
• Multiple vulnerabilities in IBM B2B Advanced Communications
• Multiple vulnerabilities in API Gateway and API Manager
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in IBM Application Performance Management products
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Multiple vulnerabilities in IBM Integration Designer
• Multiple vulnerabilities in Dell Support Assist Enterprise
• Multiple vulnerabilities in IBM Storage Virtualize
• Multiple vulnerabilities in IBM watsonx.data
• IBM watsonx.data update for FasterXML jackson-databind
• Fedora 29 update for bouncycastle, eclipse-jgit, eclipse-linuxtools, jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-dataformats-text, jackson-datatype-jdk8, jackson-datatype-jo
• Multiple vulnerabilities in Red Hat Single Sign-On 7.3
• Multiple vulnerabilities in Cloudera Observability on Premises with IBM
• Multiple vulnerabilities in IBM Sterling Partner Engagement Manager Essentials Edition