XXE attack in jackson-databind - CVE-2018-14720

Vulnerability identifier: #VU17777

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2018-14720

CWE-ID: CWE-611

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
jackson-databind
z/Transaction Processing Facility ( z/TPF)
Log Analysis
IBM Process Mining
OpenShift Logging
IBM Sterling B2B Integrator
IBM Cloud Application Performance Management (APM)
IBM Security Verify Governance
jackson-databind (Debian package)
bouncycastle
rh-maven35-jackson-databind (Red Hat package)
jackson-parent
jackson-annotations
jackson-bom
jackson-core
jackson-databind
jackson-dataformat-xml
jackson-dataformats-binary
jackson-dataformats-text
jackson-datatype-jdk8
jackson-datatype-joda
jackson-datatypes-collections
jackson-jaxrs-providers
jackson-module-jsonSchema
jackson-modules-base
eclipse-jgit
eclipse-linuxtools
Cloudera Observability with IBM
Dell Support Assist Enterprise
Integration Designer
Storage Virtualize
Red Hat OpenShift Container Platform
IBM Disconnected Log Collector
JBoss Data Grid
Fuse
Fedora
watsonx.data
Red Hat Single Sign-On

The disclosed vulnerability allows a remote attacker to perform XXE attacks.

The vulnerability exists due to fail to block unspecified Java Development Kit (JDK) classes from polymorphic deserialization. A remote attacker can send a specially crafted request that submits malicious input, conduct an XXE attack to access sensitive information, bypass security restrictions, or cause a denial of service (DoS) condition on the targeted system. 

Update to version 2.9.7.

• https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44
• https://github.com/FasterXML/jackson-databind/issues/2097
• https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7
• https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html