CVE-2018-12023

Aliases:GHSA-6wqp-v4v6-c87cDEBIAN-CVE-2018-12023CGA-2vcr-h848-w9mjCGA-89p2-wc8j-qmpjCGA-c5pp-ph22-8hrqCGA-ccmh-q357-qpcqCGA-fr4m-3cp9-xjgwCGA-jjm5-cc6v-6rjcCGA-phr7-pcq3-c6xfCGA-v29w-6mgp-c375CGA-2cfj-h6j9-6f62CGA-9r2f-hw46-7xrwCGA-cm6m-cw29-3jpvCGA-h8xw-3w26-hq33CGA-j796-mw53-798vCGA-w445-mcrh-mv96CGA-2c66-2fcf-r2rpCGA-5qqh-r89r-f8jgCGA-74wf-3w5w-f9h2CGA-c9fc-rqq9-f9jrCGA-fq9p-368w-g8cpCGA-j7p5-g54j-68jjCGA-qf4c-h364-3xm8CGA-wv94-p9ww-f4jpCGA-246j-ghfj-6xr6CGA-677w-hq4q-69frCGA-jh7m-c5m6-gvfxCGA-rjpg-93fw-m6c2
Advisory lineage Upstream: 0 Downstream: 8
Modified
Published: 17 Mar 2019, 17:57
Last modified:05 Aug 2024, 08:24

Vulnerability Summary

Overall Risk (default)
medium
32/100
CVSS Score
7.5 HIGH
v3.0 (nvd)
EPSS Score
8.94% LOW
9% probability +4.13%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

17 Mar 2019, 17:57
Published
Vulnerability first disclosed
05 Aug 2024, 08:24
Last Modified
Vulnerability information updated

Description

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.

CVSS Metrics

  • v3.0•HIGH•Score: 7.5CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
  • v2.0•MEDIUM•Score: 5.1AV:N/AC:H/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 8.94%• Percentile: 95%

Techniques & Countermeasures

  • CWE-502•Deserialization of Untrusted Data

    The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected Systems

  • chainguard•eco-java-gradle-4.10

    all

  • chainguard•eco-java-gradle-4.10.1

    all

  • chainguard•eco-java-gradle-4.10.2

    all

  • chainguard•eco-java-gradle-4.10.3

    all

  • chainguard•eco-java-gradle-4.4

    all

  • chainguard•eco-java-gradle-4.4.1

    all

  • chainguard•eco-java-gradle-4.5

    all

  • chainguard•eco-java-gradle-4.5.1

    all

  • chainguard•eco-java-gradle-4.6

    all

  • chainguard•eco-java-gradle-4.7

    all

  • chainguard•eco-java-gradle-4.8

    all

  • chainguard•eco-java-gradle-4.8.1

    all

  • chainguard•eco-java-gradle-4.9

    all

  • debian•jackson-databind

    < 2.9.8-1 | < 2.9.8-1 | < 2.9.8-1 | < 2.9.8-1

  • debian•debian_linux

    9.0

  • fasterxml•jackson-databind

    ≥ 2.7.0, < 2.7.9.4 | ≥ 2.8.0, < 2.8.11.2 | ≥ 2.9.0, < 2.9.6

  • fedoraproject•fedora

    29

  • com.fasterxml.jackson.core•jackson-databind

    ≥ 2.7.0, < 2.7.9.4 | ≥ 2.8.0, < 2.8.11.2 | ≥ 2.9.0, < 2.9.6

  • oracle•jd_edwards_enterpriseone_tools

    9.2

  • oracle•retail_merchandising_system

    15.0

  • redhat•automation_manager

    7.3.1

  • redhat•decision_manager

    7.3.1

  • redhat•jboss_brms

    6.4.10

  • redhat•jboss_enterprise_application_platform

    7.2.0

  • redhat•openshift_container_platform

    3.11

  • redhat•single_sign-on

    7.3

References (48)