CVE-2018-14718: Critical severity fasterxml jackson-databind vulnerability
Published Jan 2, 2019
·Updated
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
Other sources
FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, 2.7.9.5, and 2.6.7.3 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
Affected Software
67 affected componentsFixes available
maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.6.7.3
2.6.7.3
maven/com.fasterxml.jackson.core:jackson-databind>=2.7.0<=2.7.9.4
2.7.9.5
maven/com.fasterxml.jackson.core:jackson-databind>=2.8.0<=2.8.11.2
2.8.11.3
maven/com.fasterxml.jackson.core:jackson-databind>=2.9.0<2.9.7
2.9.7
debian/jackson-databind
2.9.8-3+deb10u32.9.8-3+deb10u52.12.1-1+deb11u12.14.0-1
fasterxml jackson-databind>=2.0.0<2.6.7.3
fasterxml jackson-databind>=2.7.0<2.7.9.5
fasterxml jackson-databind>=2.8.0<2.8.11.3
fasterxml jackson-databind>=2.9.0<2.9.7
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Oracle Banking Platform=2.5.0
Oracle Banking Platform=2.6.0
Oracle Banking Platform=2.6.1
Oracle Banking Platform=2.6.2
Oracle Business Process Management Suite=12.1.3.0.0
Oracle Business Process Management Suite=12.2.1.3.0
Oracle Communications Billing and Revenue Management=7.5
Oracle Communications Billing and Revenue Management=12.0
Oracle Communications Instant Messaging Server=10.0.1.3.0
Oracle Enterprise Manager For Virtualization=13.2.2
Oracle Enterprise Manager For Virtualization=13.2.3
Oracle Enterprise Manager For Virtualization=13.3.1
Oracle Financial Services Analytical Applications Infrastructure=8.0.2
Oracle Financial Services Analytical Applications Infrastructure=8.0.3
Oracle Financial Services Analytical Applications Infrastructure=8.0.4
Oracle Financial Services Analytical Applications Infrastructure=8.0.5
Oracle Financial Services Analytical Applications Infrastructure=8.0.6
Oracle Financial Services Analytical Applications Infrastructure=8.0.7
Oracle Global Lifecycle Management Opatch<11.2.0.3.23
Oracle Global Lifecycle Management Opatch>=12.2.0.1.0<12.2.0.1.19
Oracle Global Lifecycle Management Opatch>=13.9.4.0.0<13.9.4.2.1
Oracle JD Edwards EnterpriseOne Orchestrator=9.2
Oracle JD Edwards EnterpriseOne Tools=9.2
Oracle JDeveloper=12.1.3.0.0
Oracle JDeveloper=12.2.1.3.0
Oracle Nosql Database<19.3.12
Oracle Nosql Database=19.3.12
Oracle Primavera P6 Enterprise Project Portfolio Management>=17.7<=17.12
Oracle Primavera P6 Enterprise Project Portfolio Management=15.1
Oracle Primavera P6 Enterprise Project Portfolio Management=15.2
Oracle Primavera P6 Enterprise Project Portfolio Management=16.1
Oracle Primavera P6 Enterprise Project Portfolio Management=16.2
Oracle Primavera P6 Enterprise Project Portfolio Management=18.8
Oracle Primavera Unifier>=17.7<=17.12
Oracle Primavera Unifier=16.1
Oracle Primavera Unifier=16.2
Oracle Primavera Unifier=18.8
Oracle Retail Customer Management and Segmentation Foundation=17.0
Oracle Retail Merchandising System=15.0
Oracle Retail Merchandising System=16.0
Oracle Retail Workforce Management Software=1.60.9.0.0
Oracle Siebel Engineering - Installer \& Deployment<=19.8
Oracle Siebel UI Framework<=19.10
Oracle WebCenter Portal=12.2.1.3.0
NetApp OnCommand Workflow Automation
NetApp Snapcenter
NetApp Steelstore Cloud Integrated Storage
redhat OpenShift Container Platform>=3.11<3.11.153
redhat OpenShift Container Platform>=4.6<4.6.26
redhat OpenShift Container Platform=3.10
redhat OpenShift Container Platform>=4.1<4.1.18
redhat Enterprise Linux=7.0
redhat/jackson-databind<2.9.7
2.9.7
redhat/jackson-databind<2.7.9.5
2.7.9.5
redhat/jackson-databind<2.8.11.3
2.8.11.3
IBM InfoSphere Data Architect<=9.2.1
Remediation
Patch Available
Event History
Jan 2, 2019
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Jan 4, 2019
Advisory Published
07:06 PM
Jan 15, 2019
Data Sourced
via Red Hat·06:40 PM
DescriptionSeverityAffected Software
Mar 4, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2018-14718?
CVE-2018-14718 is classified as critical due to its potential for remote code execution.
2
How do I fix CVE-2018-14718?
To mitigate CVE-2018-14718, upgrade jackson-databind to version 2.9.7 or later.
3
Which versions of jackson-databind are affected by CVE-2018-14718?
Versions of jackson-databind below 2.9.7, specifically all versions from 2.0.0 to 2.9.6, are vulnerable to CVE-2018-14718.
4
Is my software vulnerable if I use Jackson version 2.8.11?
Yes, Jackson version 2.8.11 is vulnerable to CVE-2018-14718; you must upgrade to at least version 2.8.11.3.
5
Can CVE-2018-14718 affect my web application?
Yes, if your web application uses a vulnerable version of jackson-databind, it can be exploited to execute arbitrary code.