Yüksek CVSS 8.1

CVE-2018-5968: Jackson-databind: güvenlik açığı

Yayın: 22 Ocak 2018 07:29 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.

Özet bilgiler

Ürün: Fasterxml Jackson-databind
CVSS v3.1: 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: %7,25 (yüzdelik 94)
CWE: CWE-184
Yama: Yok / bilinmiyor

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
fasterxml-jackson-databind	2.0.0	—	2.6.7.3
fasterxml-jackson-databind	2.7.0	—	2.7.9.2
fasterxml-jackson-databind	2.8.0	—	2.8.11.1
fasterxml-jackson-databind	2.9.0	—	2.9.4
debian-debian-linux	8.0	8.0	—
debian-debian-linux	9.0	9.0	—
redhat-openshift-container-platform	4.1	4.1	—
redhat-virtualization	4.0	4.0	—
redhat-virtualization-host	4.0	4.0	—
redhat-jboss-enterprise-application-platform	7.1	7.1	—
redhat-openshift-container-platform	3.11	3.11	—
netapp-e-series-santricity-os-controller	11.0.0	11.60.3	—
netapp-e-series-santricity-web-services-proxy	—	—	—
netapp-oncommand-shift	—	—	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları