Deserialization of Untrusted Data in jackson-databind - CVE-2018-12022

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU19942

Deserialization of Untrusted Data in jackson-databind - CVE-2018-12022

Published: August 6, 2019


Vulnerability identifier: #VU19942
CSH Severity: Medium
CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-12022
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists when Default Typing is enabled and the service has the Jodd-db jar in the classpath. A remote attacker can provide an LDAP service to access and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

jackson-databind
z/Transaction Processing Facility ( z/TPF)
Log Analysis
JBoss A-MQ
IBM Cloud Application Performance Management (APM)
jackson-databind (Debian package)
bouncycastle
rh-maven35-jackson-databind (Red Hat package)
jackson-parent
jackson-dataformats-binary
jackson-dataformat-xml
jackson-databind
jackson-core
jackson-bom
jackson-dataformats-text
jackson-datatype-jdk8
jackson-annotations
jackson-datatype-joda
jackson-datatypes-collections
jackson-jaxrs-providers
jackson-module-jsonSchema
jackson-modules-base
eclipse-jgit
eclipse-linuxtools
Cloudera Observability with IBM
Dell Support Assist Enterprise
Integration Designer
Storage Virtualize
Red Hat OpenShift Container Platform
Oracle Clusterware
IBM Disconnected Log Collector
Fuse
JBoss Data Virtualization
JBoss Data Grid
Fedora
watsonx.data
Red Hat Single Sign-On

How to mitigate CVE-2018-12022

Install updates from vendor's website.

jackson-databind - addressed in versions 2.7.9.4, 2.8.11.2, 2.9.6
Log Analysis - addressed in versions 1.3.7.2 IF001, 1.3.7.2 IF002, 1.3.7.2 IF003
jackson-databind (Debian package) - update to 2.8.6-1+deb9u5
Cloudera Observability with IBM - update to 3.6.2
Dell Support Assist Enterprise - update to 4.00.06.00
Fuse - addressed in versions 6.3.13, 7.5.0
JBoss Data Virtualization - update to 6.4.8
JBoss Data Grid - update to 7.3.2
IBM Disconnected Log Collector - update to 1.8.3
bouncycastle - update to 1.61-1.fc29
watsonx.data - update to 2.0.3
rh-maven35-jackson-databind (Red Hat package) - update to 2.7.6-2.5.el7
jackson-parent - update to 2.9.1.2-1.fc29
jackson-dataformats-binary - update to 2.9.8-1.fc29
jackson-dataformat-xml - update to 2.9.8-1.fc29
jackson-databind - update to 2.9.8-1.fc29
jackson-core - update to 2.9.8-1.fc29
jackson-bom - update to 2.9.8-1.fc29
jackson-dataformats-text - update to 2.9.8-1.fc29
jackson-datatype-jdk8 - update to 2.9.8-1.fc29
jackson-annotations - update to 2.9.8-1.fc29
jackson-datatype-joda - update to 2.9.8-1.fc29
jackson-datatypes-collections - update to 2.9.8-1.fc29
jackson-jaxrs-providers - update to 2.9.8-1.fc29
jackson-module-jsonSchema - update to 2.9.8-1.fc29
jackson-modules-base - update to 2.9.8-1.fc29
eclipse-jgit - update to 5.2.0-4.fc29
eclipse-linuxtools - update to 7.1.0-3.fc29
Red Hat Single Sign-On - update to 7.3.1
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
Storage Virtualize - addressed in versions 8.6.3.0, 8.7.0.0

External References

Related Security Bulletins