CVE-2018-5968

CWE-184CWE-502 — Deserialization of Untrusted Data12 documents7 sources
Severity
8.1HIGH
EPSS
2.0%
top 16.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Fasterxml Jackson-databindNetapp E-series Santricity OS ControllerDebian Debian Linux+4 more
Timeline
PublishedJan 22
Latest updateMay 24

Description

FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages7 packages

▶NVDfasterxml/jackson-databind2.0.0 — 2.6.7.3+3
▶Debianjackson-databind< 2.9.4-1+3

Also affects: Debian Linux 8.0, 9.0, Openshift Container Platform 3.11, 4.1

🔴Vulnerability Details

5
GHSA
Deserialization of Untrusted Data in org.codehaus.jackson:jackson-mapper-asl↗2022-05-24
▶
GHSA
Deserialization of Untrusted Data in jackson-databind↗2020-06-30
▶
OSV
Deserialization of Untrusted Data in jackson-databind↗2020-06-30
▶
OSV
CVE-2018-5968: FasterXML jackson-databind through 2↗2018-01-22
▶
CVEList
CVE-2018-5968: FasterXML jackson-databind through 2↗2018-01-22
▶

📋Vendor Advisories

3
Red Hat
codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities↗2019-09-30
▶
Red Hat
jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485)↗2018-01-18
▶
Debian
CVE-2018-5968: jackson-databind - FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthe...↗2018
▶

💬Community

3
Bugzilla
CVE-2019-10202 codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities↗2019-07-18
▶
Bugzilla
CVE-2018-5968 jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485)↗2018-01-24
▶
Bugzilla
CVE-2018-5968 jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485) [fedora-all]↗2018-01-24
▶
CVE-2018-5968 (HIGH CVSS 8.1) | FasterXML jackson-databind through | cvebase.io