CVE-2018-11307
Aliases:GHSA-qr7j-h6gg-jmgcDEBIAN-CVE-2018-11307CGA-3vvj-2vrc-q855CGA-456h-hqv9-wg3qCGA-479p-3xqw-mqhvCGA-4rqw-pj7v-3m47CGA-57qr-rpmw-2qrjCGA-6m9g-8vrf-m83vCGA-7hrf-rpcc-7ww4CGA-94r4-5h24-wwqgCGA-9q2c-h5g8-prw7CGA-9vq5-4632-3g4fCGA-c74v-5qhm-mwwgCGA-cm8j-x96r-37mwCGA-f45x-hpx6-5jv7CGA-fcg9-wxjw-356qCGA-fgxw-88xq-6hg9CGA-g8g9-qgrh-7x33CGA-h748-7pp7-g2r6CGA-h7hp-2p7g-p8r9CGA-j594-xw44-qcqgCGA-jcmw-qghh-vjw6CGA-jf6r-28rw-rcghCGA-jq53-x8cc-cx23CGA-jrm9-g497-cc47CGA-mgmp-jvq9-q8cgCGA-mx45-57pw-vj8xCGA-p5g2-2gg2-rmh9CGA-pmg3-gf3w-jrgwCGA-qv5r-mmqv-3pq9CGA-rpx2-qv8g-mcffCGA-rqph-93m5-vwcpCGA-vxhg-3gf3-4j47CGA-w5ch-fxpq-xvm8CGA-w877-25rf-8q83CGA-x76q-jwjc-vmp7CGA-x7jx-5c6c-cv5cCGA-24rm-jww2-8mppCGA-353w-j337-cj83CGA-5c9q-mxrq-83xpCGA-6mjq-r63p-fpm4CGA-7593-g7ff-pqpfCGA-7q22-r57g-x55gCGA-9353-qpcf-r56xCGA-9qjm-fx5f-jc3xCGA-c3v3-m74p-p9pcCGA-fv4q-8h59-w7cwCGA-gmfg-f7ph-w2p7CGA-j32v-5v4p-4rc7CGA-m25f-9pv8-p87jCGA-m3jf-jw9f-c8q9CGA-mgrp-8q67-24wjCGA-mrpg-7v5w-fr99CGA-pghc-9c5v-h3rwCGA-q9jm-x6xh-qc3qCGA-x3fj-6rr4-xh8vCGA-26jj-2f89-4r4cCGA-3x8x-h3hx-hx3hCGA-429v-g5f7-6c2cCGA-52jj-hcwr-mp87CGA-5h3x-r9h8-xj6pCGA-6f82-9rwf-jq7jCGA-6m57-g5mf-7v67CGA-7448-w482-hmx7CGA-745j-3hq2-6vmpCGA-86pc-h6m6-g7vmCGA-8jc8-p2c3-wxgcCGA-939p-g9gg-5wqvCGA-frf5-3j2r-2p2wCGA-gpvw-fj4x-4wx7CGA-h437-9fv7-f4q3CGA-jvwx-hfgq-j774CGA-mqj2-8f74-xg33CGA-q7rf-qchr-gph2CGA-qh2x-vf48-gpwjCGA-rx8w-5c59-hf6rCGA-vhw8-5p99-434wCGA-w559-m76v-x8xxCGA-w6qm-m497-4mf6CGA-x374-35q2-g852CGA-xfxp-mj89-8jphCGA-2gmx-qcgc-392hCGA-2m56-jrp9-392qCGA-36mv-3xgq-x4pjCGA-4gfr-f7m3-pp3jCGA-624m-9jx6-8vmjCGA-6266-hc22-8qw7CGA-7f3r-92g8-m8v5CGA-7fgh-fph2-9q8xCGA-87mr-7rgx-hcvcCGA-9g3f-7798-rr35CGA-9qj8-w5xp-5h3gCGA-h924-4hcj-qj23CGA-hc86-c7j6-2qwfCGA-mw76-ch72-m25pCGA-pm76-q6g2-3frhCGA-q9f9-rqc5-fj49CGA-qcvg-4889-hw4xCGA-v3gx-r38f-vjrxCGA-w882-76x4-5wvrCGA-xcmg-vr5c-8c2x
Advisory lineage Upstream: 0 Downstream: 8
Modified
Published: 09 Jul 2019, 15:37
Last modified:05 Aug 2024, 08:01
Vulnerability Summary
Overall Risk (default)
high
70/100 CVSS Score
9.8 CRITICAL
v3.1 (nvd)
EPSS Score
5.73% LOW
6% probability -6.91%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
09 Jul 2019, 15:37
Published
Vulnerability first disclosed
05 Aug 2024, 08:01
Last Modified
Vulnerability information updated
Description
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
CVSS Metrics
- v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS Trends
Current EPSS score: 5.73%• Percentile: 93%
Techniques & Countermeasures
- CWE-502•Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Affected Systems
- chainguard•eco-java-gradle-2.10
all
- chainguard•eco-java-gradle-2.11
all
- chainguard•eco-java-gradle-2.12
all
- chainguard•eco-java-gradle-2.13
all
- chainguard•eco-java-gradle-2.14
all
- chainguard•eco-java-gradle-2.14.1
all
- chainguard•eco-java-gradle-2.4
all
- chainguard•eco-java-gradle-2.5
all
- chainguard•eco-java-gradle-2.6
all
- chainguard•eco-java-gradle-2.7
all
- chainguard•eco-java-gradle-2.8
all
- chainguard•eco-java-gradle-2.9
all
- chainguard•eco-java-gradle-3.0
all
- chainguard•eco-java-gradle-3.1
all
- chainguard•eco-java-gradle-3.2
all
- chainguard•eco-java-gradle-3.2.1
all
- chainguard•eco-java-gradle-3.3
all
- chainguard•eco-java-gradle-3.4
all
- chainguard•eco-java-gradle-3.4.1
all
- chainguard•eco-java-gradle-3.5
all
- chainguard•eco-java-gradle-3.5.1
all
- chainguard•eco-java-gradle-4.0
all
- chainguard•eco-java-gradle-4.0.1
all
- chainguard•eco-java-gradle-4.0.2
all
- chainguard•eco-java-gradle-4.1
all
- chainguard•eco-java-gradle-4.10
all
- chainguard•eco-java-gradle-4.10.1
all
- chainguard•eco-java-gradle-4.10.2
all
- chainguard•eco-java-gradle-4.10.3
all
- chainguard•eco-java-gradle-4.2
all
- chainguard•eco-java-gradle-4.2.1
all
- chainguard•eco-java-gradle-4.3
all
- chainguard•eco-java-gradle-4.3.1
all
- chainguard•eco-java-gradle-4.4
all
- chainguard•eco-java-gradle-4.4.1
all
- chainguard•eco-java-gradle-4.5
all
- chainguard•eco-java-gradle-4.5.1
all
- chainguard•eco-java-gradle-4.6
all
- chainguard•eco-java-gradle-4.7
all
- chainguard•eco-java-gradle-4.8
all
- chainguard•eco-java-gradle-4.8.1
all
- chainguard•eco-java-gradle-4.9
all
- chainguard•hadoop-fips-3.3.6
all
- chainguard•hadoop-fips-3.4.2
all
- chainguard•hadoop-fips-3.5
all
- debian•jackson-databind
< 2.9.8-1 | < 2.9.8-1 | < 2.9.8-1 | < 2.9.8-1
- fasterxml•jackson-databind
≥ 2.0.0, < 2.6.7.3 | ≥ 2.7.0, < 2.7.9.4 | ≥ 2.8.0, < 2.8.11.2 | ≥ 2.9.0, < 2.9.6
- com.fasterxml.jackson.core•jackson-databind
≥ 2.0.0, < 2.7.9.4 | ≥ 2.8.0, < 2.8.11.2 | ≥ 2.9.0, < 2.9.6
- oracle•clusterware
12.1.0.2.0
- oracle•communications_instant_messaging_server
10.0.1.2.0
Showing first 50 affected entries in server-rendered view.
References (32)
- https://access.redhat.com/errata/RHSA-2019:1822
- https://access.redhat.com/errata/RHSA-2019:1823
- https://access.redhat.com/errata/RHSA-2019:2804
- https://access.redhat.com/errata/RHSA-2019:2858
- https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d%40%3Cissues.lucene.apache.org%3E
- https://access.redhat.com/errata/RHSA-2019:3002
- https://access.redhat.com/errata/RHSA-2019:3140
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
- https://access.redhat.com/errata/RHSA-2019:3149
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
- https://access.redhat.com/errata/RHSA-2019:3892
- https://access.redhat.com/errata/RHSA-2019:4037
- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-7525
- https://access.redhat.com/errata/RHSA-2019:0782
- https://github.com/FasterXML/jackson-databind/issues/2032
- https://nvd.nist.gov/vuln/detail/CVE-2018-11307
- https://github.com/FasterXML/jackson-databind/commit/051bd5e447fbc9539e12a4fe90eb989dba0c656
- https://github.com/FasterXML/jackson-databind/commit/27b4defc270454dea6842bd9279f17387eceb73
- https://github.com/FasterXML/jackson-databind/commit/78e78738d69adcb59fdac9fc12d9053ce8809f3d
- https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d@%3Cissues.lucene.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://github.com/FasterXML/jackson-databind
- https://security-tracker.debian.org/tracker/CVE-2018-11307