Deserialization of Untrusted Data in jackson-databind - CVE-2018-12023

Vulnerability identifier: #VU19943

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-12023

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists when Default Typing is enabled and the service has the Oracle JDBC jar in the classpath. A remote attacker can provide an LDAP service to access and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

jackson-databind
z/Transaction Processing Facility ( z/TPF)
Log Analysis
JBoss A-MQ
IBM Cloud Application Performance Management (APM)
Oracle Utilities Advanced Spatial and Operational Analytics
jackson-databind (Debian package)
bouncycastle
rh-maven35-jackson-databind (Red Hat package)
jackson-parent
jackson-dataformats-binary
jackson-dataformat-xml
jackson-databind
jackson-core
jackson-bom
jackson-dataformats-text
jackson-datatype-jdk8
jackson-annotations
jackson-datatype-joda
jackson-datatypes-collections
jackson-jaxrs-providers
jackson-module-jsonSchema
jackson-modules-base
eclipse-jgit
eclipse-linuxtools
Cloudera Observability with IBM
Dell Support Assist Enterprise
Integration Designer
Storage Virtualize
Red Hat OpenShift Container Platform
Enterprise Manager for Virtualization
IBM Disconnected Log Collector
Fuse
JBoss Data Virtualization
JBoss Data Grid
Oracle Communications Instant Messaging Server
Fedora
watsonx.data
Red Hat Single Sign-On

Install updates from vendor's website.

jackson-databind - addressed in versions 2.7.9.4, 2.8.11.2, 2.9.6
Log Analysis - addressed in versions 1.3.7.2 IF001, 1.3.7.2 IF002, 1.3.7.2 IF003
jackson-databind (Debian package) - update to 2.8.6-1+deb9u5
Cloudera Observability with IBM - update to 3.6.2
Dell Support Assist Enterprise - update to 4.00.06.00
Fuse - addressed in versions 6.3.13, 7.5.0
JBoss Data Virtualization - update to 6.4.8
JBoss Data Grid - update to 7.3.2
IBM Disconnected Log Collector - update to 1.8.3
bouncycastle - update to 1.61-1.fc29
watsonx.data - update to 2.0.3
rh-maven35-jackson-databind (Red Hat package) - update to 2.7.6-2.5.el7
jackson-parent - update to 2.9.1.2-1.fc29
jackson-dataformats-binary - update to 2.9.8-1.fc29
jackson-dataformat-xml - update to 2.9.8-1.fc29
jackson-databind - update to 2.9.8-1.fc29
jackson-core - update to 2.9.8-1.fc29
jackson-bom - update to 2.9.8-1.fc29
jackson-dataformats-text - update to 2.9.8-1.fc29
jackson-datatype-jdk8 - update to 2.9.8-1.fc29
jackson-annotations - update to 2.9.8-1.fc29
jackson-datatype-joda - update to 2.9.8-1.fc29
jackson-datatypes-collections - update to 2.9.8-1.fc29
jackson-jaxrs-providers - update to 2.9.8-1.fc29
jackson-module-jsonSchema - update to 2.9.8-1.fc29
jackson-modules-base - update to 2.9.8-1.fc29
eclipse-jgit - update to 5.2.0-4.fc29
eclipse-linuxtools - update to 7.1.0-3.fc29
Red Hat Single Sign-On - update to 7.3.1
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
Storage Virtualize - addressed in versions 8.6.3.0, 8.7.0.0

• https://github.com/FasterXML/jackson-databind/commit/28badf7ef60ac3e7ef151cd8e8ec010b8479226a
• https://github.com/FasterXML/jackson-databind/issues/2058

• Debian update for jackson-databind
• Red Hat update for JBoss Fuse/A-MQ
• Red Hat update for OpenShift Container Platform 4.1.18 logging-elasticsearch5
• Red Hat update for FIS 2.0 on Fuse 6.3.0 R13
• Red Hat update for OpenShift Container Platform logging-elasticsearch5-container
• Multiple vulnerabilities in Red Hat JBoss Data Virtualization
• Multiple vulnerabilities in Red Hat Fuse
• Multiple vulnerabilities in Red Hat Data Grid
• Multiple vulnerabilities in z/Transaction Processing Facility
• IBM Log Analysis update for FasterXML jackson-databind
• Red Hat Software Collections update for rh-maven35-jackson-databind
• Multiple vulnerabilities in IBM Application Performance Management products
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Multiple vulnerabilities in IBM Integration Designer
• Multiple vulnerabilities in Dell Support Assist Enterprise
• Multiple vulnerabilities in IBM Storage Virtualize
• IBM watsonx.data update for FasterXML jackson-databind
• Fedora 29 update for bouncycastle, eclipse-jgit, eclipse-linuxtools, jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-dataformats-text, jackson-datatype-jdk8, jackson-datatype-jo
• Multiple vulnerabilities in Red Hat Single Sign-On 7.3
• Multiple vulnerabilities in Oracle Communications Instant Messaging Server
• Multiple vulnerabilities in Oracle Utilities Advanced Spatial and Operational Analytics
• Multiple vulnerabilities in Cloudera Observability on Premises with IBM
• Multiple vulnerabilities in Enterprise Manager for Virtualization