CVEvulnerability

CVE-2018-1000873

6.5 MEDIUM Published 2018-12-20 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-12-20
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:N/A:P
Weaknesses
CWE-20

Description

Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.

Affected configurations

• fasterxml jackson-modules-java8 (< 2.9.8) • oracle clusterware 12.1.0.2.0 • oracle database server 12.1.0.2 • oracle database server 12.2.0.1 • oracle database server 18c • oracle database server 19c • oracle global lifecycle management opatch (< 11.2.0.3.23) • oracle global lifecycle management opatch (>= 12.2.0.1.0 < 12.2.0.1.19) • oracle global lifecycle management opatch (>= 13.9.4.0.0 < 13.9.4.2.1) • oracle nosql database (< 19.3.12) • netapp active iq unified manager (>= 7.3) • netapp active iq unified manager (>= 9.5)

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References