CVE-2018-12023: High severity fasterxml jackson-databind vulnerability
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
Other sources
FasterXML jackson-databind before versions 2.7.9.4, 2.8.11.2, 2.9.6 fails to block polymorphic deserialization of types from Oracle JDBC driver. This could lead to Remote Code Execution.
Reference: https://github.com/FasterXML/jackson-databind/issues/2058
Upstream Patch: https://github.com/FasterXML/jackson-databind/commit/7487cf7eb14be2f65a1eb108e8629c07ef45e0a1
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2018-12023.
What is the severity level of CVE-2018-12023?
CVE-2018-12023 has a severity level of 8.1 (High).
Which products are affected by CVE-2018-12023?
CVE-2018-12023 affects multiple Oracle products and IBM Disconnected Log Collector.
What is the affected version of jackson-databind?
The affected versions of jackson-databind are 2.7.9.4, 2.8.11.2, and 2.9.6.
Are there any remediation steps available?
Yes, there are remediation steps available for jackson-databind. Please refer to the official sources for specific remediation steps.