CVE-2018-1000873
published 2018-12-20CVE-2018-1000873: Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a…
PriorityP433medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
4.76%
90.9th percentile
Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fasterxml | jackson-modules-java8 | < 2.9.8 | 2.9.8 |
| netapp | active_iq_unified_manager | >= 7.3 | — |
| netapp | active_iq_unified_manager | >= 9.5 | — |
| oracle | clusterware | — | — |
| oracle | database_server | — | — |
| oracle | database_server | — | — |
| oracle | database_server | — | — |
| oracle | database_server | — | — |
| oracle | global_lifecycle_management_opatch | < 11.2.0.3.23 | 11.2.0.3.23 |
| oracle | global_lifecycle_management_opatch | >= 12.2.0.1.0 < 12.2.0.1.19 | 12.2.0.1.19 |
| oracle | global_lifecycle_management_opatch | >= 13.9.4.0.0 < 13.9.4.2.1 | 13.9.4.2.1 |
| oracle | nosql_database | < 19.3.12 | 19.3.12 |
| redhat | jboss_enterprise_application_platform | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
ghsa9.8CRITICAL
osv9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Deserialization of Untrusted Data in org.codehaus.jackson:jackson-mapper-asl
ghsa·2022-05-24·CVSS 9.8
CVE-2019-10202 [CRITICAL] CWE-502 Deserialization of Untrusted Data in org.codehaus.jackson:jackson-mapper-asl
Deserialization of Untrusted Data in org.codehaus.jackson:jackson-mapper-asl
A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike.
OSV
Deserialization of Untrusted Data in org.codehaus.jackson:jackson-mapper-asl
osv·2022-05-24·CVSS 9.8
CVE-2019-10202 [CRITICAL] Deserialization of Untrusted Data in org.codehaus.jackson:jackson-mapper-asl
Deserialization of Untrusted Data in org.codehaus.jackson:jackson-mapper-asl
A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike.
OSV
Moderate severity vulnerability that affects com.fasterxml.jackson.datatype:jackson-datatype-jsr353
osv·2018-12-21
CVE-2018-1000873 [MEDIUM] Moderate severity vulnerability that affects com.fasterxml.jackson.datatype:jackson-datatype-jsr353
Moderate severity vulnerability that affects com.fasterxml.jackson.datatype:jackson-datatype-jsr353
Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Databind that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.
GHSA
Moderate severity vulnerability that affects com.fasterxml.jackson.datatype:jackson-datatype-jsr353
ghsa·2018-12-21
CVE-2018-1000873 [MEDIUM] CWE-20 Moderate severity vulnerability that affects com.fasterxml.jackson.datatype:jackson-datatype-jsr353
Moderate severity vulnerability that affects com.fasterxml.jackson.datatype:jackson-datatype-jsr353
Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Databind that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.
OSV
CVE-2018-1000873: Fasterxml Jackson version Before 2
osv·2018-12-20·CVSS 6.5
CVE-2018-1000873 [MEDIUM] CVE-2018-1000873: Fasterxml Jackson version Before 2
Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.
Red Hat
codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities
vendor_redhat·2019-09-30·CVSS 9.8
CVE-2019-10202 [CRITICAL] CWE-502 codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities
codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities
A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike.
Package: codehaus (Red Hat BPM Suite 6) - Out of support scope
Package: codehaus (Red Hat Decision Manager 7) - Not affected
Package: codehaus (Red Hat JBoss A-MQ 6) - Out of support scope
Package: codehaus (Red Hat JBoss BRMS 5) - Out of support scope
Package: codehaus (Red Hat JBoss BRMS 6) - Out of support scope
Package: codehaus
Red Hat
jackson-modules-java8: DoS due to an Improper Input Validation
vendor_redhat·2018-10-24·CVSS 6.5
CVE-2018-1000873 [MEDIUM] CWE-20 jackson-modules-java8: DoS due to an Improper Input Validation
jackson-modules-java8: DoS due to an Improper Input Validation
Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.
Package: jackson-databind (Red Hat BPM Suite 6) - Not affected
Package: jackson-datatype-jsr310 (Red Hat Decision Manager 7) - Not affected
Package: jackson-databind (Red Hat Enterprise Linux 8) - Not affected
Package: jackson-databind (Red Hat JBoss A-MQ 6) - Not affected
Package: jackson-databind (Red Hat JBoss BRMS 6) - Not affected
Packa
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-10202 codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities
bugzilla·2019-07-18·CVSS 9.8
CVE-2019-10202 [CRITICAL] CVE-2019-10202 codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities
CVE-2019-10202 codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities
A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike.
Discussion:
This vulnerability is out of security support scope for the following products:
* Red Hat JBoss BPM Suite 6
* Red Hat JBoss BRMS 6
* Red Hat Enterprise Application Platform 5
* Red Hat Enterprise Application Platform 6
* Red Hat JBoss SOA Platform 5
* Red Hat JBoss Fuse Service Works 6
* Red Hat JBoss Fuse 6
*
Bugzilla
CVE-2018-1000873 jackson-datatype-jsr310: jackson-modules-java8: DoS due to an Improper Input Validation [fedora-all]
bugzilla·2019-01-17·CVSS 6.5
CVE-2018-1000873 [MEDIUM] CVE-2018-1000873 jackson-datatype-jsr310: jackson-modules-java8: DoS due to an Improper Input Validation [fedora-all]
CVE-2018-1000873 jackson-datatype-jsr310: jackson-modules-java8: DoS due to an Improper Input Validation [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this i
Bugzilla
CVE-2018-1000873 jackson-databind: jackson-modules-java8: DoS due to an Improper Input Validation [fedora-all]
bugzilla·2019-01-11·CVSS 6.5
CVE-2018-1000873 [MEDIUM] CVE-2018-1000873 jackson-databind: jackson-modules-java8: DoS due to an Improper Input Validation [fedora-all]
CVE-2018-1000873 jackson-databind: jackson-modules-java8: DoS due to an Improper Input Validation [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue af
Bugzilla
CVE-2018-1000873 jackson-modules-java8: DoS due to an Improper Input Validation
bugzilla·2019-01-11·CVSS 6.5
CVE-2018-1000873 [MEDIUM] CVE-2018-1000873 jackson-modules-java8: DoS due to an Improper Input Validation
CVE-2018-1000873 jackson-modules-java8: DoS due to an Improper Input Validation
Fasterxml Jackson version Before 2.9.8 contains an Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in a denial-of-service (DoS) when the victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value.
References:
https://github.com/FasterXML/jackson-modules-java8/issues/90
Upstream Patch:
https://github.com/FasterXML/jackson-modules-java8/pull/87
Discussion:
Created jackson-databind tracking bugs for this issue:
Affects: fedora-all [bug 1665603]
---
Created jackson-datatype-jsr310 tracking bugs for this issue:
Affects: fedora-all [bug 1667118]
---
rhvm-appliance includes the affected package eap7-jackson-datatype-jsr310,
arXiv
How well does LLM generate security tests?
arxiv_fulltext·2023-10-03
How well does LLM generate security tests?
How well does LLM generate security tests?
## Abstract
Developers often build software on top of third-party libraries (Libs) to improve programmer productivity and software quality. The libraries may contain vulnerabilities exploitable by hackers to attack the applications (Apps) built on top of them. People refer to such attacks as supply chain attacks, the documented number of which has increased 742% in 2022. People created tools to mitigate such attacks, by scanning the library dependencies of Apps, identifying the usage of vulnerable library versions, and suggesting secure alternatives to vulnerable dependencies. However, recent studies show that many developers do not trust the reports by these tools; they ask for code or evidence to demonstrate how library vulnerabilities lead to
https://bugzilla.redhat.com/show_bug.cgi?id=1665601https://github.com/FasterXML/jackson-modules-java8/issues/90https://github.com/FasterXML/jackson-modules-java8/pull/87https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3Ehttps://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3Ehttps://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20200904-0004/https://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1665601https://github.com/FasterXML/jackson-modules-java8/issues/90https://github.com/FasterXML/jackson-modules-java8/pull/87https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3Ehttps://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3Ehttps://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20200904-0004/https://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
2018-12-20
Published