Input validation error in jackson-databind - CVE-2018-14719

Vulnerability identifier: #VU17778

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2018-14719

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
jackson-databind
z/Transaction Processing Facility ( z/TPF)
Log Analysis
IBM Process Mining
OpenShift Logging
JBoss A-MQ
IBM Cloud Application Performance Management (APM)
IBM Security Verify Governance
jackson-databind (Debian package)
bouncycastle
rh-maven35-jackson-databind (Red Hat package)
jackson-parent
jackson-core
jackson-databind
jackson-dataformat-xml
jackson-bom
jackson-annotations
jackson-dataformats-binary
jackson-datatype-jdk8
jackson-dataformats-text
jackson-datatype-joda
jackson-datatypes-collections
jackson-jaxrs-providers
jackson-module-jsonSchema
jackson-modules-base
eclipse-jgit
eclipse-linuxtools
Cloudera Observability with IBM
Dell Support Assist Enterprise
Integration Designer
B2B Advanced Communications
Multi-Enterprise Integration Gateway
Storage Virtualize
Red Hat OpenShift Container Platform
IBM Disconnected Log Collector
Fuse
JBoss Data Virtualization
JBoss Data Grid
Fedora
watsonx.data

The disclosed vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to fail to block blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization. A remote attacker can send a specially crafted request that submits malicious input to execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

Update to version 2.9.7.

• https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44
• https://github.com/FasterXML/jackson-databind/issues/2097
• https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7
• https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html