İçeriğe geç
Bilgi ve Teknoloji Uygulamada aç

Kritik CVSS 9.8

CVE-2018-7489: Jackson-databind: güvenlik açığı

Yayın: · Güncelleme:

Açıklama (NVD)

FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.

Özet bilgiler

Ürün
Fasterxml Jackson-databind
CVSS v3.1
9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
%19,78 (yüzdelik 97)
CWE
CWE-184
Yama
Mevcut

Etkilenen sürümler

ÜrünBaşlangıçBitişDüzeltildi
fasterxml-jackson-databind——2.7.9.3
fasterxml-jackson-databind2.8.0—2.8.11.1
fasterxml-jackson-databind2.9.0—2.9.5
debian-debian-linux8.08.0—
debian-debian-linux9.09.0—
oracle-communications-billing-and-revenue-management7.57.5—
oracle-communications-billing-and-revenue-management12.012.0—
oracle-communications-instant-messaging-server10.0.110.0.1—
redhat-jboss-enterprise-application-platform6.4.196.4.19—
redhat-jboss-enterprise-application-platform7.1.27.1.2—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları