Input validation error in jackson-databind - CVE-2018-19362

Vulnerability identifier: #VU17781

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2018-19362

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
jackson-databind
z/Transaction Processing Facility ( z/TPF)
Log Analysis
IBM Process Mining
OpenShift Logging
JBoss A-MQ
Oracle Financial Services Price Creation and Discovery
Oracle Financial Services Institutional Performance Analytics
Oracle Financial Services Profitability Management
Oracle Insurance Allocation Manager for Enterprise Profitability
IBM Cloud Application Performance Management (APM)
IBM Security Verify Governance
Oracle Banking Platform
Cloudera Observability with IBM
Dell Support Assist Enterprise
Oracle Retail Xstore Point of Service
Oracle Financial Services Analytical Applications Infrastructure
MICROS Retail XBRi Loss Prevention
Integration Designer
Storage Virtualize
jackson-databind (Debian package)
bouncycastle
rh-maven35-jackson-databind (Red Hat package)
jackson-parent
jackson-annotations
jackson-bom
jackson-core
jackson-databind
jackson-dataformats-text
jackson-dataformat-xml
jackson-dataformats-binary
jackson-datatype-jdk8
jackson-datatype-joda
jackson-datatypes-collections
jackson-jaxrs-providers
jackson-module-jsonSchema
jackson-modules-base
eclipse-jgit
eclipse-linuxtools
Red Hat OpenShift Container Platform
JD Edwards EnterpriseOne Tools
Enterprise Manager for Virtualization
IBM Disconnected Log Collector
Fuse
Primavera Gateway
JBoss Data Virtualization
JBoss Data Grid
Oracle Communications Unified
Oracle Financial Services Retail Customer Analytics
Oracle Financial Services Funds Transfer Pricing
Oracle Insurance Performance Insight
Oracle Retail Customer Management and Segmentation Foundation
Fedora
watsonx.data

The disclosed vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code.

The vulnerability exists due to fail to block the jboss-common-coreclass from polymorphic deserialization. A remote attacker can send a specially crafted request that submits malicious input to perform unauthorized actions on the system, which could allow the attacker to execute arbitrary code or cause a denial of service (DoS) condition.

Update to version 2.9.8.

• https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b
• https://github.com/FasterXML/jackson-databind/issues/2186
• https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8
• https://issues.apache.org/jira/browse/TINKERPOP-2121