Kritik CVSS 9.8

CVE-2018-19361: Jackson-databind: güvenilmeyen verinin serileştirmeden çıkarılması

Yayın: 2 Ocak 2019 21:29 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.

Özet bilgiler

Ürün: Fasterxml Jackson-databind
CVSS v3.1: 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: %10,60 (yüzdelik 96)
CWE: CWE-502
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
fasterxml-jackson-databind	2.6.0	2.6.7.2	—
fasterxml-jackson-databind	2.7.0	—	2.7.9.5
fasterxml-jackson-databind	2.8.0	—	2.8.11.3
fasterxml-jackson-databind	2.9.0	—	2.9.8
debian-debian-linux	8.0	8.0	—
debian-debian-linux	9.0	9.0	—
oracle-business-process-management-suite	12.1.3.0.0	12.1.3.0.0	—
oracle-business-process-management-suite	12.2.1.3.0	12.2.1.3.0	—
oracle-primavera-p6-enterprise-project-portfolio-management	17.7	17.12	—
oracle-primavera-p6-enterprise-project-portfolio-management	15.1	15.1	—
oracle-primavera-p6-enterprise-project-portfolio-management	15.2	15.2	—
oracle-primavera-p6-enterprise-project-portfolio-management	16.1	16.1	—
oracle-primavera-p6-enterprise-project-portfolio-management	16.2	16.2	—
oracle-primavera-p6-enterprise-project-portfolio-management	18.8	18.8	—
oracle-primavera-unifier	17.7	17.12	—
oracle-primavera-unifier	16.1	16.1	—
oracle-primavera-unifier	16.2	16.2	—
oracle-primavera-unifier	18.8	18.8	—
oracle-retail-workforce-management-software	1.60.9.0.0	1.60.9.0.0	—
oracle-webcenter-portal	12.2.1.3.0	12.2.1.3.0	—
redhat-automation-manager	7.3.1	7.3.1	—
redhat-decision-manager	7.3.1	7.3.1	—
redhat-jboss-bpm-suite	6.4.11	6.4.11	—
redhat-jboss-brms	6.4.10	6.4.10	—
redhat-openshift-container-platform	3.11	3.11	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları