CVE-2018-12022
Aliases:GHSA-cjjf-94ff-43w7DEBIAN-CVE-2018-12022CGA-4264-433w-3fffCGA-4rmv-33rr-pcr3CGA-5c79-f593-7c8qCGA-65rm-64xw-cx9fCGA-6gwg-2h6f-xw9wCGA-8hpx-8gwr-pr82CGA-8vmv-g55q-x9g7CGA-c8wj-vp28-fq99CGA-cf6r-w93w-xqjcCGA-g372-vvpx-r2v6CGA-g5vj-rr8v-h4wfCGA-ggfj-rqq2-2vw2CGA-gv35-fjvp-w9ccCGA-h3mp-wgc3-5w9cCGA-h7pj-x6cp-58r6CGA-hcp7-v9gr-frhqCGA-hq27-crxr-9c4pCGA-j9g2-jjh7-7jcrCGA-jxqv-rggv-4pwcCGA-m85p-w2q2-5gmqCGA-p5qx-9xwh-fqcgCGA-q3pr-22gp-c6xvCGA-qh97-grfc-7qvpCGA-qjq6-8vfw-98fmCGA-rfxp-mx46-5m58CGA-rm53-8j57-c9hmCGA-rwc6-3rqw-ppqjCGA-vmcc-7p4f-wcf2CGA-w62w-343p-hrccCGA-w6c2-7wpg-7q78CGA-x5g5-wmc5-5gf6CGA-x5hm-7j7g-h9j5CGA-x638-q2x7-h5rhCGA-x8c7-5xxq-rwp5CGA-5xrm-4766-xc59CGA-6vm7-9gq2-g4jgCGA-75wg-fgp6-82mrCGA-7cgm-fqj8-55f3CGA-9fvg-9g9x-hxjmCGA-9m5m-9wgh-m477CGA-cv59-qfhc-m3r9CGA-fcwf-6486-449fCGA-g4jw-x7ph-8hpxCGA-hm7v-2ww3-xp77CGA-jqrj-g5vc-8p73CGA-jvhj-mmjh-qmqmCGA-jxjp-4rvv-h6vwCGA-qv36-2prc-w3pvCGA-v2h2-j72h-x3gpCGA-w4mp-h4wq-8c3vCGA-xp7g-vwq9-mmg2CGA-2945-qm5p-wggqCGA-38xf-pcqr-gmvqCGA-3q24-5c4q-v7g5CGA-3vh3-3552-97cpCGA-45pj-j59w-j44vCGA-464j-vm75-vhw2CGA-4r55-gmp5-649qCGA-5rmc-fwpr-7f7rCGA-5xcv-q8vf-7j4jCGA-6ggg-74ff-8w37CGA-749j-v6m2-m8gvCGA-cgp8-jghv-r2fpCGA-gc32-jg26-gq37CGA-h3hw-7g5h-rghcCGA-hgmh-56xv-pvhwCGA-hmq3-qpqv-x3fcCGA-hqhr-vgx4-jg7mCGA-jg63-phr5-9c42CGA-q8mc-c34c-85qpCGA-v5h5-4q87-p5vqCGA-wpp8-86gq-r45gCGA-wvjq-h73f-2jmgCGA-ww5p-j9gg-64r3CGA-x6pg-vq8p-xwxpCGA-x9v8-fhw3-85fgCGA-2r3f-x7f8-f8q4CGA-2vxx-x2hx-wv2cCGA-3jjr-fxfg-mmppCGA-47q2-m9w6-gpwcCGA-4jf4-jpfv-m6grCGA-5cjg-qgrv-3hvhCGA-6fr7-wcq3-xjcqCGA-78v8-pp7q-3pcvCGA-997m-v9xf-fgfxCGA-9c8h-2j5h-g6rmCGA-9rf3-4rv6-42cmCGA-c4j7-r34h-h59pCGA-cj9q-vp5g-23gxCGA-hh22-xxp5-p83jCGA-jpwp-vp5r-88q2CGA-mfq6-jvgq-v3mjCGA-pm3h-qjf4-5mrvCGA-vq3h-rhgr-4pmfCGA-vw6v-m7cv-5q6hCGA-w39x-xjg8-8f75CGA-wxfw-mph2-rpx9CGA-x2p2-w3xv-f5mw
Advisory lineage Upstream: 0 Downstream: 8
Modified
Published: 17 Mar 2019, 18:14
Last modified:05 Aug 2024, 08:24
Vulnerability Summary
Overall Risk (default)
medium
31/100 CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
7.15% LOW
7% probability +4.12%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
17 Mar 2019, 18:14
Published
Vulnerability first disclosed
05 Aug 2024, 08:24
Last Modified
Vulnerability information updated
Description
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
CVSS Metrics
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- v3.0•HIGH•Score: 7.5CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- v2.0•MEDIUM•Score: 5.1AV:N/AC:H/Au:N/C:P/I:P/A:P
EPSS Trends
Current EPSS score: 7.15%• Percentile: 94%
Techniques & Countermeasures
- CWE-502•Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Affected Systems
- chainguard•eco-java-gradle-2.10
all
- chainguard•eco-java-gradle-2.11
all
- chainguard•eco-java-gradle-2.12
all
- chainguard•eco-java-gradle-2.13
all
- chainguard•eco-java-gradle-2.14
all
- chainguard•eco-java-gradle-2.14.1
all
- chainguard•eco-java-gradle-2.4
all
- chainguard•eco-java-gradle-2.5
all
- chainguard•eco-java-gradle-2.6
all
- chainguard•eco-java-gradle-2.7
all
- chainguard•eco-java-gradle-2.8
all
- chainguard•eco-java-gradle-2.9
all
- chainguard•eco-java-gradle-3.0
all
- chainguard•eco-java-gradle-3.1
all
- chainguard•eco-java-gradle-3.2
all
- chainguard•eco-java-gradle-3.2.1
all
- chainguard•eco-java-gradle-3.3
all
- chainguard•eco-java-gradle-3.4
all
- chainguard•eco-java-gradle-3.4.1
all
- chainguard•eco-java-gradle-3.5
all
- chainguard•eco-java-gradle-3.5.1
all
- chainguard•eco-java-gradle-4.0
all
- chainguard•eco-java-gradle-4.0.1
all
- chainguard•eco-java-gradle-4.0.2
all
- chainguard•eco-java-gradle-4.1
all
- chainguard•eco-java-gradle-4.10
all
- chainguard•eco-java-gradle-4.10.1
all
- chainguard•eco-java-gradle-4.10.2
all
- chainguard•eco-java-gradle-4.10.3
all
- chainguard•eco-java-gradle-4.2
all
- chainguard•eco-java-gradle-4.2.1
all
- chainguard•eco-java-gradle-4.3
all
- chainguard•eco-java-gradle-4.3.1
all
- chainguard•eco-java-gradle-4.4
all
- chainguard•eco-java-gradle-4.4.1
all
- chainguard•eco-java-gradle-4.5
all
- chainguard•eco-java-gradle-4.5.1
all
- chainguard•eco-java-gradle-4.6
all
- chainguard•eco-java-gradle-4.7
all
- chainguard•eco-java-gradle-4.8
all
- chainguard•eco-java-gradle-4.8.1
all
- chainguard•eco-java-gradle-4.9
all
- chainguard•hadoop-fips-3.3.6
all
- chainguard•hadoop-fips-3.4.2
all
- chainguard•hadoop-fips-3.5
all
- debian•jackson-databind
< 2.9.8-1 | < 2.9.8-1 | < 2.9.8-1 | < 2.9.8-1
- debian•debian_linux
9.0
- fasterxml•jackson-databind
≥ 2.0.0, < 2.6.7.3 | ≥ 2.7.0, < 2.7.9.4 | ≥ 2.8.0, < 2.8.11.2 | ≥ 2.9.0, < 2.9.6
- fedoraproject•fedora
29
- com.fasterxml.jackson.core•jackson-databind
< 2.7.9.4 | ≥ 2.8.0, < 2.8.11.2 | ≥ 2.9.0, < 2.9.6
Showing first 50 affected entries in server-rendered view.
References (49)
- https://access.redhat.com/errata/RHSA-2019:0782
- https://access.redhat.com/errata/RHSA-2019:0877
- https://access.redhat.com/errata/RHBA-2019:0959
- https://access.redhat.com/errata/RHSA-2019:1107
- https://access.redhat.com/errata/RHSA-2019:1108
- https://access.redhat.com/errata/RHSA-2019:1106
- https://access.redhat.com/errata/RHSA-2019:1140
- https://www.debian.org/security/2019/dsa-4452
- https://seclists.org/bugtraq/2019/May/68
- https://access.redhat.com/errata/RHSA-2019:1782
- https://access.redhat.com/errata/RHSA-2019:1797
- http://www.securityfocus.com/bid/107585
- https://access.redhat.com/errata/RHSA-2019:1822
- https://access.redhat.com/errata/RHSA-2019:1823
- https://access.redhat.com/errata/RHSA-2019:2804
- https://access.redhat.com/errata/RHSA-2019:2858
- https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d%40%3Cissues.lucene.apache.org%3E
- https://access.redhat.com/errata/RHSA-2019:3002
- https://access.redhat.com/errata/RHSA-2019:3140
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
- https://access.redhat.com/errata/RHSA-2019:3149
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
- https://access.redhat.com/errata/RHSA-2019:3892
- https://access.redhat.com/errata/RHSA-2019:4037
- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZEDLDUYBSTDY4GWDBUXGJNS2RFYTFVRC/
- https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf
- https://security.netapp.com/advisory/ntap-20190530-0003/
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1671098
- https://github.com/FasterXML/jackson-databind/issues/2052
- https://github.com/FasterXML/jackson-databind/commit/28badf7ef60ac3e7ef151cd8e8ec010b8479226a
- https://nvd.nist.gov/vuln/detail/CVE-2018-12022
- https://github.com/FasterXML/jackson-databind/commit/7487cf7eb14be2f65a1eb108e8629c07ef45e0a
- https://github.com/FasterXML/jackson-databind/commit/bf261d404c2f79fd3406237710d40ebb03c99d84
- https://github.com/advisories/GHSA-cjjf-94ff-43w7
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d@%3Cissues.lucene.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZEDLDUYBSTDY4GWDBUXGJNS2RFYTFVRC
- https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://security.netapp.com/advisory/ntap-20190530-0003
- https://github.com/FasterXML/jackson-databind
- https://security-tracker.debian.org/tracker/CVE-2018-12022