Input validation error in jackson-databind - CVE-2018-19361

Vulnerability identifier: #VU17779

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2018-19361

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
jackson-databind
z/Transaction Processing Facility ( z/TPF)
Log Analysis
IBM Process Mining
OpenShift Logging
JBoss A-MQ
IBM Sterling B2B Integrator
IBM Cloud Application Performance Management (APM)
IBM Security Verify Governance
jackson-databind (Debian package)
bouncycastle
rh-maven35-jackson-databind (Red Hat package)
jackson-parent
jackson-core
jackson-bom
jackson-annotations
jackson-datatype-jdk8
jackson-databind
jackson-dataformat-xml
jackson-dataformats-binary
jackson-dataformats-text
jackson-datatype-joda
jackson-datatypes-collections
jackson-jaxrs-providers
jackson-module-jsonSchema
jackson-modules-base
eclipse-jgit
eclipse-linuxtools
Cloudera Observability with IBM
Dell Support Assist Enterprise
Integration Designer
Storage Virtualize
Red Hat OpenShift Container Platform
IBM Disconnected Log Collector
Fuse
JBoss Data Virtualization
JBoss Data Grid
Fedora
watsonx.data

The disclosed vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code.

The vulnerability exists due to fail to block the openjpa class from polymorphic deserialization. A remote attacker can send a specially crafted request that submits malicious input to perform unauthorized actions on the system, which could allow the attacker to execute arbitrary code or cause a denial of service (DoS) condition.

Update to version 2.9.8.

• https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b
• https://github.com/FasterXML/jackson-databind/issues/2186
• https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8
• https://issues.apache.org/jira/browse/TINKERPOP-2121