Deserialization of Untrusted Data in jackson-databind - CVE-2018-11307

Vulnerability identifier: #VU19938

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-11307

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to the usage of default typing along with a gadget class from iBatis, which allows exfiltration of content. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

jackson-databind
z/Transaction Processing Facility ( z/TPF)
Log Analysis
JBoss A-MQ
IBM Cloud Application Performance Management (APM)
jackson-databind (Debian package)
rh-maven35-jackson-databind (Red Hat package)
Cloudera Observability with IBM
Dell Support Assist Enterprise
Integration Designer
Storage Virtualize
Red Hat OpenShift Container Platform
IBM Disconnected Log Collector
Fuse
JBoss Data Virtualization
JBoss Data Grid
watsonx.data
Red Hat Single Sign-On

Install updates from vendor's website.

jackson-databind - addressed in versions 2.7.9.4, 2.8.11.2, 2.9.6
Log Analysis - addressed in versions 1.3.7.2 IF001, 1.3.7.2 IF002, 1.3.7.2 IF003
jackson-databind (Debian package) - update to 2.8.6-1+deb9u5
Cloudera Observability with IBM - update to 3.6.2
Dell Support Assist Enterprise - update to 4.00.06.00
Fuse - addressed in versions 6.3.13, 7.5.0
JBoss Data Virtualization - update to 6.4.8
JBoss Data Grid - update to 7.3.2
IBM Disconnected Log Collector - update to 1.8.3
watsonx.data - addressed in versions 2.0.2, 2.0.3
rh-maven35-jackson-databind (Red Hat package) - update to 2.7.6-2.5.el7
Red Hat Single Sign-On - update to 7.3.1
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
Storage Virtualize - addressed in versions 8.6.3.0, 8.7.0.0

• https://github.com/FasterXML/jackson-databind/issues/2032
• https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062

• Debian update for jackson-databind
• Red Hat update for JBoss Fuse/A-MQ
• Red Hat update for OpenShift Container Platform 4.1.18 logging-elasticsearch5
• Red Hat update for FIS 2.0 on Fuse 6.3.0 R13
• Red Hat update for OpenShift Container Platform logging-elasticsearch5-container
• Multiple vulnerabilities in Red Hat JBoss Data Virtualization
• Multiple vulnerabilities in Red Hat Fuse
• Multiple vulnerabilities in Red Hat Data Grid
• Multiple vulnerabilities in z/Transaction Processing Facility
• IBM Log Analysis update for FasterXML jackson-databind
• Red Hat Software Collections update for rh-maven35-jackson-databind
• Multiple vulnerabilities in IBM Application Performance Management products
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Multiple vulnerabilities in IBM Integration Designer
• Multiple vulnerabilities in Dell Support Assist Enterprise
• Multiple vulnerabilities in IBM Storage Virtualize
• Multiple vulnerabilities in IBM watsonx.data
• IBM watsonx.data update for FasterXML jackson-databind
• Multiple vulnerabilities in Red Hat Single Sign-On 7.3
• Multiple vulnerabilities in Cloudera Observability on Premises with IBM