CVEvulnerability

CVE-2018-5968

8.1 HIGH Published 2018-01-22 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2018-01-22
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-184, CWE-502

Description

FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.

Affected configurations

• fasterxml jackson-databind (>= 2.0.0 < 2.6.7.3) • fasterxml jackson-databind (>= 2.7.0 < 2.7.9.2) • fasterxml jackson-databind (>= 2.8.0 < 2.8.11.1) • fasterxml jackson-databind (>= 2.9.0 < 2.9.4) • debian debian linux 8.0 • debian debian linux 9.0 • redhat openshift container platform 4.1 • redhat virtualization 4.0 • redhat virtualization host 4.0 • redhat jboss enterprise application platform 7.1 • redhat openshift container platform 3.11 • netapp e-series santricity os controller (>= 11.0.0 <= 11.60.3) • netapp e-series santricity web services proxy • netapp oncommand shift

Related

Weakness · CWE (2)

  • CWE-184 Incomplete List of Disallowed Inputs weakness
  • CWE-502 Deserialization of Untrusted Data weakness

References