CVE-2018-14718
published 2019-01-02CVE-2018-14718: FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from…
PriorityP262critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
12.68%
95.8th percentile
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
Affected
60 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | jackson-databind | < jackson-databind 2.9.8-1 (bookworm) | jackson-databind 2.9.8-1 (bookworm) |
| fasterxml | jackson-databind | >= 0 < 2.9.8-1 | 2.9.8-1 |
| fasterxml | jackson-databind | >= 0 < 2.9.8-1 | 2.9.8-1 |
| fasterxml | jackson-databind | >= 0 < 2.9.8-1 | 2.9.8-1 |
| fasterxml | jackson-databind | >= 0 < 2.9.8-1 | 2.9.8-1 |
| fasterxml | jackson-databind | >= 0 < 2.4.2-3ubuntu0.1~esm2 | 2.4.2-3ubuntu0.1~esm2 |
| fasterxml | jackson-databind | >= 2.0.0 < 2.6.7.3 | 2.6.7.3 |
| fasterxml | jackson-databind | >= 2.7.0 < 2.7.9.5 | 2.7.9.5 |
| fasterxml | jackson-databind | >= 2.8.0 < 2.8.11.3 | 2.8.11.3 |
| fasterxml | jackson-databind | >= 2.9.0 < 2.9.7 | 2.9.7 |
| oracle | banking_platform | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_platform | — | — |
| oracle | business_process_management_suite | — | — |
| oracle | business_process_management_suite | — | — |
| oracle | communications_billing_and_revenue_management | — | — |
| oracle | communications_billing_and_revenue_management | — | — |
| oracle | communications_instant_messaging_server | — | — |
| oracle | enterprise_manager_for_virtualization | — | — |
| oracle | enterprise_manager_for_virtualization | — | — |
| oracle | enterprise_manager_for_virtualization | — | — |
| oracle | financial_services_analytical_applications_infrastructure | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for polymorphic deserialization attempts referencing slf4j-ext classes (e.g., `org.slf4j.ext`) in JSON payloads processed by jackson-databind 2.x before 2.9.7. ↗
- →Look for `@class`, `@type`, or `@JsonTypeInfo`-driven JSON fields containing slf4j-ext class names as indicators of exploitation attempts against vulnerable jackson-databind instances. ↗
- →Track the upstream patch commit (87d29af25e82a249ea15858e2d4ecbf64091db44) to confirm whether deployed jackson-databind versions include the slf4j-ext blocklist fix. ↗
- ·Applications that use only a patched version of slf4j (fixing CVE-2018-8088) are not vulnerable, even if running a vulnerable jackson-databind version, because the underlying slf4j-ext gadget is neutralized. ↗
- ·Deployments that do not bundle or use the slf4j-ext JAR are not vulnerable regardless of jackson-databind version. ↗
- ·Even though slf4j is part of OpenDaylight-parent aggregator, the versions included are not vulnerable, and specifically the slf4j-ext library is not in use — illustrating that presence of slf4j alone is insufficient; slf4j-ext must be on the classpath. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
jackson-databind vulnerabilities
osv·2021-03-15·CVSS 9.8
CVE-2018-11307 [CRITICAL] jackson-databind vulnerabilities
jackson-databind vulnerabilities
It was discovered that Jackson Databind incorrectly handled
deserialization. An attacker could possibly use this issue to obtain
sensitive information. (CVE-2018-11307, CVE-2019-12086, CVE-2019-12814)
It was discovered that Jackson Databind incorrectly handled
deserialization. An attacker could possibly use this issue to execute
arbitrary code or other unspecified impact. (CVE-2018-12022,
CVE-2018-12023, CVE-2018-14718, CVE-2018-14719, CVE-2018-19360,
CVE-2018-19361, CVE-2018-19362, CVE-2019-12384, CVE-2019-14379,
CVE-2019-14439, CVE-2019-14540, CVE-2019-16335, CVE-2019-16942,
CVE-2019-16943, CVE-2019-17267, CVE-2019-17531, CVE-2019-20330,
CVE-2020-10672, CVE-2020-10673, CVE-2020-10968, CVE-2020-10969,
CVE-2020-11111, CVE-2020-11112, CVE-2020-11113, CVE-2
GHSA
Arbitrary Code Execution in jackson-databind
ghsa·2019-01-04
CVE-2018-14718 [CRITICAL] CWE-502 Arbitrary Code Execution in jackson-databind
Arbitrary Code Execution in jackson-databind
FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, 2.7.9.5, and 2.6.7.3 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
OSV
Arbitrary Code Execution in jackson-databind
osv·2019-01-04
CVE-2018-14718 [CRITICAL] Arbitrary Code Execution in jackson-databind
Arbitrary Code Execution in jackson-databind
FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, 2.7.9.5, and 2.6.7.3 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
OSV
CVE-2018-14718: FasterXML jackson-databind 2
osv·2019-01-02·CVSS 9.8
CVE-2018-14718 [CRITICAL] CVE-2018-14718: FasterXML jackson-databind 2
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
Ubuntu
Jackson Databind vulnerabilities
vendor_ubuntu·2021-03-15·CVSS 9.8
CVE-2019-14540 [CRITICAL] Jackson Databind vulnerabilities
Title: Jackson Databind vulnerabilities
Summary: Several security issues were fixed in Jackson Databind.
It was discovered that Jackson Databind incorrectly handled
deserialization. An attacker could possibly use this issue to obtain
sensitive information. (CVE-2018-11307, CVE-2019-12086, CVE-2019-12814)
It was discovered that Jackson Databind incorrectly handled
deserialization. An attacker could possibly use this issue to execute
arbitrary code or other unspecified impact. (CVE-2018-12022,
CVE-2018-12023, CVE-2018-14718, CVE-2018-14719, CVE-2018-19360,
CVE-2018-19361, CVE-2018-19362, CVE-2019-12384, CVE-2019-14379,
CVE-2019-14439, CVE-2019-14540, CVE-2019-16335, CVE-2019-16942,
CVE-2019-16943, CVE-2019-17267, CVE-2019-17531, CVE-2019-20330,
CVE-2020-10672, CVE-2020-10673, CVE-2020-109
Red Hat
jackson-databind: arbitrary code execution in slf4j-ext class
vendor_redhat·2018-07-27·CVSS 8.1
CVE-2018-14718 [HIGH] CWE-502 jackson-databind: arbitrary code execution in slf4j-ext class
jackson-databind: arbitrary code execution in slf4j-ext class
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using slf4j classes. An attacker could use this flaw to execute arbitrary code.
Statement: This vulnerability in jackson-databind involves exploiting CVE-2018-1088 against slf4j, which was fixed in Red Hat products through the errata referenced at https://access.redhat.com/security/cve/cve-2018-8088. Applications that link only slf4j versions including that fix are not vulnerable to this vulnerability.
Red Hat Satellite 6 is not aff
Debian
CVE-2018-14718: jackson-databind - FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to exec...
vendor_debian·2018·CVSS 9.8
CVE-2018-14718 [CRITICAL] CVE-2018-14718: jackson-databind - FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to exec...
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
Scope: local
bookworm: resolved (fixed in 2.9.8-1)
bullseye: resolved (fixed in 2.9.8-1)
forky: resolved (fixed in 2.9.8-1)
sid: resolved (fixed in 2.9.8-1)
trixie: resolved (fixed in 2.9.8-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-14718 jackson-databind: arbitrary code execution in slf4j-ext class [fedora-all]
bugzilla·2019-01-15·CVSS 9.8
CVE-2018-14718 [CRITICAL] CVE-2018-14718 jackson-databind: arbitrary code execution in slf4j-ext class [fedora-all]
CVE-2018-14718 jackson-databind: arbitrary code execution in slf4j-ext class [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple suppor
Bugzilla
CVE-2018-14718 jackson-databind: arbitrary code execution in slf4j-ext class
bugzilla·2019-01-15·CVSS 8.1
CVE-2018-14718 [HIGH] CVE-2018-14718 jackson-databind: arbitrary code execution in slf4j-ext class
CVE-2018-14718 jackson-databind: arbitrary code execution in slf4j-ext class
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
References:
https://github.com/FasterXML/jackson-databind/issues/2097
https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7
Upstream Patch:
https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44
Discussion:
Created jackson-databind tracking bugs for this issue:
Affects: fedora-all [bug 1666416]
---
Statement:
This vulnerability in jackson-databind involves exploiting CVE-2018-1088 against slf4j, which was fixed in Red Hat products through the errata referenced at https://acce
http://www.securityfocus.com/bid/106601https://access.redhat.com/errata/RHBA-2019:0959https://access.redhat.com/errata/RHSA-2019:0782https://access.redhat.com/errata/RHSA-2019:0877https://access.redhat.com/errata/RHSA-2019:1782https://access.redhat.com/errata/RHSA-2019:1797https://access.redhat.com/errata/RHSA-2019:1822https://access.redhat.com/errata/RHSA-2019:1823https://access.redhat.com/errata/RHSA-2019:2804https://access.redhat.com/errata/RHSA-2019:2858https://access.redhat.com/errata/RHSA-2019:3002https://access.redhat.com/errata/RHSA-2019:3140https://access.redhat.com/errata/RHSA-2019:3149https://access.redhat.com/errata/RHSA-2019:3892https://access.redhat.com/errata/RHSA-2019:4037https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44https://github.com/FasterXML/jackson-databind/issues/2097https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/6a78f88716c3c57aa74ec05764a37ab3874769a347805903b393b286%40%3Cdev.lucene.apache.org%3Ehttps://lists.apache.org/thread.html/82b01bfb6787097427ce97cec6a7127e93718bc05d1efd5eaffc228f%40%3Cdev.lucene.apache.org%3Ehttps://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/ba973114605d936be276ee6ce09dfbdbf78aa56f6cdc6e79bfa7b8df%40%3Cdev.lucene.apache.org%3Ehttps://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3Ehttps://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2019/03/msg00005.htmlhttps://seclists.org/bugtraq/2019/May/68https://security.netapp.com/advisory/ntap-20190530-0003/https://www.debian.org/security/2019/dsa-4452https://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/security-alerts/cpujan2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlhttps://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlhttp://www.securityfocus.com/bid/106601https://access.redhat.com/errata/RHBA-2019:0959https://access.redhat.com/errata/RHSA-2019:0782https://access.redhat.com/errata/RHSA-2019:0877https://access.redhat.com/errata/RHSA-2019:1782https://access.redhat.com/errata/RHSA-2019:1797https://access.redhat.com/errata/RHSA-2019:1822https://access.redhat.com/errata/RHSA-2019:1823https://access.redhat.com/errata/RHSA-2019:2804https://access.redhat.com/errata/RHSA-2019:2858https://access.redhat.com/errata/RHSA-2019:3002https://access.redhat.com/errata/RHSA-2019:3140https://access.redhat.com/errata/RHSA-2019:3149https://access.redhat.com/errata/RHSA-2019:3892https://access.redhat.com/errata/RHSA-2019:4037https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44https://github.com/FasterXML/jackson-databind/issues/2097https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/6a78f88716c3c57aa74ec05764a37ab3874769a347805903b393b286%40%3Cdev.lucene.apache.org%3Ehttps://lists.apache.org/thread.html/82b01bfb6787097427ce97cec6a7127e93718bc05d1efd5eaffc228f%40%3Cdev.lucene.apache.org%3Ehttps://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/ba973114605d936be276ee6ce09dfbdbf78aa56f6cdc6e79bfa7b8df%40%3Cdev.lucene.apache.org%3Ehttps://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3Ehttps://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2019/03/msg00005.htmlhttps://seclists.org/bugtraq/2019/May/68https://security.netapp.com/advisory/ntap-20190530-0003/https://www.debian.org/security/2019/dsa-4452https://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/security-alerts/cpujan2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlhttps://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
2019-01-02
Published