Kritik CVSS 9.8

CVE-2018-11307: Jackson-databind: güvenilmeyen verinin serileştirmeden çıkarılması

Yayın: 9 Temmuz 2019 19:15 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.

Özet bilgiler

Ürün: Fasterxml Jackson-databind
CVSS v3.1: 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: %5,73 (yüzdelik 93)
CWE: CWE-502
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
fasterxml-jackson-databind	2.0.0	—	2.6.7.3
fasterxml-jackson-databind	2.7.0	—	2.7.9.4
fasterxml-jackson-databind	2.8.0	—	2.8.11.2
fasterxml-jackson-databind	2.9.0	—	2.9.6
redhat-openshift-container-platform	3.11	3.11	—
redhat-openshift-container-platform	4.1	4.1	—
oracle-clusterware	12.1.0.2.0	12.1.0.2.0	—
oracle-communications-instant-messaging-server	10.0.1.2.0	10.0.1.2.0	—
oracle-global-lifecycle-management-opatch	—	—	11.2.0.3.23
oracle-global-lifecycle-management-opatch	12.2.0.1.0	—	12.2.0.1.19
oracle-global-lifecycle-management-opatch	13.9.4.0.0	—	13.9.4.2.1
oracle-retail-customer-management-and-segmentation-foundation	17.0	17.0	—
oracle-utilities-advanced-spatial-and-operational-analytics	2.7.0.1	2.7.0.1	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları