GitStock

fasterxml/jackson-databind · Security

FasterXML jackson-databind allows unauthenticated remote code execution

GHSA ID
GHSA-cggj-fvv3-cqwv
CVE ID
CVE-2018-7489
Severity
critical
Published
Updated
CVSS
9.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v3
9.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

FasterXML jackson-databind before before 2.6.7.5, 2.7.x before 2.7.9.3, 2.8.x before 2.8.11.1, and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.

CWEs

  • CWE-184 · Incomplete List of Disallowed Inputs
  • CWE-502 · Deserialization of Untrusted Data

References