CVE-2018-14720: XEE
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block some JDK classes from polymorphic deserialization.
References: https://github.com/FasterXML/jackson-databind/issues/2097 https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7
Upstream Patch: https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44
Other sources
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-14720?
CVE-2018-14720 is a vulnerability in FasterXML jackson-databind that could allow a remote attacker to obtain sensitive information.
How does CVE-2018-14720 work?
CVE-2018-14720 is caused by an XML external entity (XXE) error when processing XML data by JDK classes.
What is the severity of CVE-2018-14720?
CVE-2018-14720 has a severity rating of 5.3 (medium).
Which versions of jackson-databind are affected by CVE-2018-14720?
Versions up to and excluding 2.9.7, 2.7.9.5, and 2.8.11.3 of jackson-databind are affected.
How do I fix CVE-2018-14720?
To fix CVE-2018-14720, update to version 2.9.7 or later of jackson-databind.