Input validation error in jackson-databind - CVE-2018-14719

Vulnerability identifier: #VU17778

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-14719

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to fail to block blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization. A remote attacker can send a specially crafted request that submits malicious input to execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

jackson-databind
z/Transaction Processing Facility ( z/TPF)
Log Analysis
IBM Process Mining
OpenShift Logging
JBoss A-MQ
IBM Cloud Application Performance Management (APM)
IBM Security Verify Governance
jackson-databind (Debian package)
bouncycastle
rh-maven35-jackson-databind (Red Hat package)
jackson-parent
jackson-core
jackson-databind
jackson-dataformat-xml
jackson-bom
jackson-annotations
jackson-dataformats-binary
jackson-datatype-jdk8
jackson-dataformats-text
jackson-datatype-joda
jackson-datatypes-collections
jackson-jaxrs-providers
jackson-module-jsonSchema
jackson-modules-base
eclipse-jgit
eclipse-linuxtools
Cloudera Observability with IBM
Dell Support Assist Enterprise
Integration Designer
B2B Advanced Communications
Multi-Enterprise Integration Gateway
Storage Virtualize
Red Hat OpenShift Container Platform
IBM Disconnected Log Collector
Fuse
JBoss Data Virtualization
JBoss Data Grid
Fedora
watsonx.data

Update to version 2.9.7.

jackson-databind - update to 2.9.7
Log Analysis - addressed in versions 1.3.7.2 IF001, 1.3.7.2 IF002, 1.3.7.2 IF003
IBM Process Mining - update to 1.12.0.4
jackson-databind (Debian package) - update to 2.8.6-1+deb9u5
Cloudera Observability with IBM - update to 3.6.2
Red Hat OpenShift Container Platform - update to 4.6.26
Dell Support Assist Enterprise - update to 4.00.06.00
OpenShift Logging - update to 5.0.3
Fuse - addressed in versions 6.3.13, 7.5.0
JBoss Data Virtualization - update to 6.4.8
JBoss Data Grid - update to 7.3.2
B2B Advanced Communications - update to 1.0.0.8
Multi-Enterprise Integration Gateway - update to 1.0.0.8
IBM Disconnected Log Collector - update to 1.8.3
bouncycastle - update to 1.61-1.fc29
watsonx.data - update to 2.0.2
rh-maven35-jackson-databind (Red Hat package) - update to 2.7.6-2.5.el7
jackson-parent - update to 2.9.1.2-1.fc29
jackson-core - update to 2.9.8-1.fc29
jackson-databind - update to 2.9.8-1.fc29
jackson-dataformat-xml - update to 2.9.8-1.fc29
jackson-bom - update to 2.9.8-1.fc29
jackson-annotations - update to 2.9.8-1.fc29
jackson-dataformats-binary - update to 2.9.8-1.fc29
jackson-datatype-jdk8 - update to 2.9.8-1.fc29
jackson-dataformats-text - update to 2.9.8-1.fc29
jackson-datatype-joda - update to 2.9.8-1.fc29
jackson-datatypes-collections - update to 2.9.8-1.fc29
jackson-jaxrs-providers - update to 2.9.8-1.fc29
jackson-module-jsonSchema - update to 2.9.8-1.fc29
jackson-modules-base - update to 2.9.8-1.fc29
eclipse-jgit - update to 5.2.0-4.fc29
eclipse-linuxtools - update to 7.1.0-3.fc29
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
Storage Virtualize - addressed in versions 8.6.3.0, 8.7.0.0
IBM Security Verify Governance - update to 10.0.1.0.4

• https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44
• https://github.com/FasterXML/jackson-databind/issues/2097
• https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7
• https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

• Multiple vulnerabilities in FasterXML jackson-databind
• Debian update for jackson-databind
• Red Hat update for JBoss Fuse/A-MQ
• Red Hat update for OpenShift Container Platform 4.1.18 logging-elasticsearch5
• Red Hat update for FIS 2.0 on Fuse 6.3.0 R13
• Red Hat update for OpenShift Container Platform logging-elasticsearch5-container
• Multiple vulnerabilities in Red Hat JBoss Data Virtualization
• Multiple vulnerabilities in Red Hat Fuse
• Multiple vulnerabilities in Red Hat Data Grid
• Multiple vulnerabilities in Red Hat OpenShift Container Platform
• Multiple vulnerabilities in Red Hat Openshift Logging
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in z/Transaction Processing Facility
• IBM Log Analysis update for FasterXML jackson-databind
• Red Hat Software Collections update for rh-maven35-jackson-databind
• Multiple vulnerabilities in IBM B2B Advanced Communications
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in IBM Application Performance Management products
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Multiple vulnerabilities in IBM Integration Designer
• Multiple vulnerabilities in Dell Support Assist Enterprise
• Multiple vulnerabilities in IBM Storage Virtualize
• Multiple vulnerabilities in IBM watsonx.data
• Fedora 29 update for bouncycastle, eclipse-jgit, eclipse-linuxtools, jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-dataformats-text, jackson-datatype-jdk8, jackson-datatype-jo
• Multiple vulnerabilities in Cloudera Observability on Premises with IBM