Yüksek CVSS 7.5

CVE-2018-12023: Jackson-databind: güvenilmeyen verinin serileştirmeden çıkarılması

Yayın: 21 Mart 2019 19:00 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.

Özet bilgiler

Ürün: Fasterxml Jackson-databind
CVSS v3.1: 7.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: %8,87 (yüzdelik 95)
CWE: CWE-502
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
fasterxml-jackson-databind	2.7.0	—	2.7.9.4
fasterxml-jackson-databind	2.8.0	—	2.8.11.2
fasterxml-jackson-databind	2.9.0	—	2.9.6
debian-debian-linux	9.0	9.0	—
fedoraproject-fedora	29	29	—
oracle-jd-edwards-enterpriseone-tools	9.2	9.2	—
oracle-retail-merchandising-system	15.0	15.0	—
redhat-automation-manager	7.3.1	7.3.1	—
redhat-decision-manager	7.3.1	7.3.1	—
redhat-jboss-brms	6.4.10	6.4.10	—
redhat-jboss-enterprise-application-platform	7.2.0	7.2.0	—
redhat-openshift-container-platform	3.11	3.11	—
redhat-single-sign-on	7.3	7.3	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları