CVE-2018-12022

Опубликовано: 21 мар. 2019

Источник: nvd

CVSS3: 7.5

CVSS2: 5.1

EPSS Низкий

Описание

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.

Ссылки

http://www.securityfocus.com/bid/107585
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHBA-2019:0959
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0782
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0877
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1106
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1107
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1108
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1140
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1782
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1797
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1822
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1823
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2804
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2858
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3002
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3140
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3149
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3892
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4037
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1671098
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*

Версия от 2.0.0 (включая) до 2.6.7.3 (исключая)

cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*

Версия от 2.7.0 (включая) до 2.7.9.4 (исключая)

cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*

Версия от 2.8.0 (включая) до 2.8.11.2 (исключая)

cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*

Версия от 2.9.0 (включая) до 2.9.6 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_merchandising_system:15.0:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:a:redhat:automation_manager:7.3.1:*:*:*:*:*:*:*

cpe:2.3:a:redhat:decision_manager:7.3.1:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_brms:6.4.10:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*

cpe:2.3:a:redhat:single_sign-on:7.3:*:*:*:*:*:*:*

EPSS

Процентиль: 86%

0.03035

Низкий

7.5 High

CVSS3

5.1 Medium

CVSS2

Дефекты

CWE-502

Связанные уязвимости

CVE-2018-12022

CVSS3: 7.5

ubuntu

почти 7 лет назад

CVE-2018-12022

CVSS3: 7.3

redhat

больше 7 лет назад

CVE-2018-12022

CVSS3: 7.5

debian

почти 7 лет назад

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4 ...

GHSA-cjjf-94ff-43w7

CVSS3: 7.5

github

почти 7 лет назад

jackson-databind Deserialization of Untrusted Data vulnerability

BDU:2019-01766

CVSS3: 8.1

fstec

больше 7 лет назад

Уязвимость библиотеки jackson-databind, связанная с восстановлением в памяти недостоверной структуры данных, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

EPSS

Процентиль: 86%

0.03035

Низкий

7.5 High

CVSS3

5.1 Medium

CVSS2

Дефекты

CWE-502