CVE-2018-12022: High severity fasterxml jackson-databind vulnerability
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
Other sources
FasterXML jackson-databind before versions 2.7.9.4, 2.8.11.2, 2.9.6 fails to block polymorphic deserialization of types from Jodd-db library. This could lead to Remote Code Execution.
Reference: https://github.com/FasterXML/jackson-databind/issues/2052
Upstream Patch: https://github.com/FasterXML/jackson-databind/commit/7487cf7eb14be2f65a1eb108e8629c07ef45e0a1
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-12022?
CVE-2018-12022 is a vulnerability in FasterXML jackson-databind that could allow a remote attacker to execute arbitrary code on the system.
What is the severity of CVE-2018-12022?
The severity of CVE-2018-12022 is critical, with a CVSS score of 9.8.
How does CVE-2018-12022 work?
CVE-2018-12022 occurs when Default Typing is enabled, the Jodd-db jar is in the classpath, and an attacker can provide an LDAP reference as a property value.
Which versions of jackson-databind are affected by CVE-2018-12022?
CVE-2018-12022 affects jackson-databind versions up to 2.7.9.4, 2.8.11.2, and 2.9.6.
How do I fix CVE-2018-12022?
To fix CVE-2018-12022, update jackson-databind to version 2.7.9.4, 2.8.11.2, or 2.9.6.