CVE-2018-5968: debian debian_linux Incomplete List of Disallowed Inputs
Modified
AliasesUBUNTU-CVE-2018-5968DEBIAN-CVE-2018-5968CGA-2954-4xwq-76v7CGA-2h38-c5xq-rgwhCGA-2mf6-98rp-rmfmCGA-2mhr-2858-7rcrCGA-2p5h-94qv-433gCGA-2pvh-94fx-4wxwCGA-2pvw-43h9-jhc8CGA-2w6q-9cjp-c4vvCGA-36xq-x6hp-rj6xCGA-3788-56q6-cjq8CGA-43r4-5f9w-v5gpCGA-482w-q892-3mvjCGA-4j56-rpv3-3p8cCGA-4wh4-23x6-p926CGA-525v-36v3-3c4fCGA-5734-x2h7-q7rhCGA-58fw-592m-37vrCGA-5crf-348c-pmxcCGA-5fmm-gf3p-rp4pCGA-5g92-7gx5-mh8wCGA-64h2-2g84-m7h2CGA-66mp-88cg-gpj3CGA-6cx7-2vgq-qr6rCGA-6v9r-g5h7-2cxfCGA-72h5-764m-3qr5CGA-73wm-c84c-r9fqCGA-7842-96ww-2cxjCGA-7fg4-pxrc-g69cCGA-7gv3-hjrh-mpvgCGA-7hx3-m3cc-q565CGA-7pwh-f545-4f36CGA-7rg2-ppv2-679fCGA-8wjw-mm3g-p48pCGA-963g-jgv8-w87cCGA-99c5-72p5-544vCGA-9p33-7v98-8frrCGA-9pj9-3mcv-mq4jCGA-c2h6-q2v7-g2fxCGA-c5xg-vcgj-mv5pCGA-c8m8-gmg5-qwh3CGA-cp62-472j-75f6CGA-fjjm-hwvx-ggr7CGA-fqjv-9jrx-66jrCGA-g8qv-f7g7-x69wCGA-g9r7-c3vh-82vxCGA-gmpj-r2m7-ffpgCGA-gppc-c6xq-phvvCGA-gvcg-8jvr-jgh9CGA-h5rr-c36j-6vrjCGA-hg76-f95h-c7prCGA-hphv-px69-j2p6CGA-j4cc-v7x5-6vqhCGA-j7jc-gqxx-cmx7CGA-j9c5-pvh2-5jfhCGA-m246-chgj-ppghCGA-m9pv-qgm3-jpq5CGA-mrmh-vj9f-jv4wCGA-p8jc-6wjr-vwx3CGA-pf6p-f9f7-jvcfCGA-pq48-xppx-pxmwGHSA-w3f4-3q6j-rh82CGA-q992-wfq9-ghx8CGA-qgpc-vj46-hc5fCGA-qjmg-27j9-4j2jCGA-qw8r-x698-395pCGA-r79c-jww5-wj29CGA-r9qv-9mgh-6qxhCGA-rf3f-p464-p58qCGA-rwr7-6mf7-fcf2CGA-vx67-74xm-mm7rCGA-vxp4-p2r4-j255CGA-x49x-g9hc-qv3pCGA-x6q9-897r-xw5xCGA-x7g3-6fpq-w9p3CGA-x83c-96xm-mr98CGA-xp7v-c8ph-qj4mCGA-xpcg-4m4q-44f5
Published 22-01-2018Last modified 08-10-2026
Vulnerability summary
CVE-2018-5968 is a high (CVSS 8.1) Incomplete List of Disallowed Inputs vulnerability in debian debian_linux. EPSS estimates a 7.25% chance of exploitation in the next 30 days, higher than 94.3% of scored vulnerabilities.
Priority
Prioritisesevere
Severe, CVSS 8.1 (NVD); no exploitation reported by the 5 checked sources; EPSS 7% (FIRST, 04-11-2026)
Source freshness unavailable
How is this decided?CVSS score
8.1/10
010
High · v3.1 (NVD)EPSS score
7.25%
0%100%
Low · +0.03 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 6Timeline
- 22-01-2018PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.
CVSS metrics
7 scores · 5 sources · 3 versionsHigh 8.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
High 8.1Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesSingle source
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
7.25%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
Increase +0.03 pp
From 7.21% on 05-10-2026
05-10-202604-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-184Incomplete List of Disallowed InputsThe product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
- CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Affected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard34 products
- eco-java-gradle-2.10All versions (No fix recorded)
- eco-java-gradle-2.11All versions (No fix recorded)
- eco-java-gradle-2.12All versions (No fix recorded)
- eco-java-gradle-2.13All versions (No fix recorded)
- eco-java-gradle-2.14All versions (No fix recorded)
Redhat4 products
Netapp3 products
- e-series_santricity_os_controller≥ 11.0.0, ≤ 11.60.3
- e-series_santricity_web_services_proxyna
- oncommand_shiftna
Debian2 products
- jackson-databind< 2.9.4-1
- debian_linuxEOL8.0 | 9.0
Com.fasterxml.jackson.core1 product
- jackson-databind≥ 2.8.0, < 2.8.11.1 | ≥ 2.9.0, < 2.9.4 | < 2.7.9.5
Fasterxml1 product
- jackson-databind≥ 2.0.0, < 2.6.7.3 | ≥ 2.7.0, < 2.7.9.2 | ≥ 2.8.0, < 2.8.11.1 | ≥ 2.9.0, < 2.9.4
Ubuntu1 product
- jackson-databind< 2.2.2-1ubuntu0.1~esm1 | < 2.4.2-3ubuntu0.1~esm1
7 vendors · 46 products
References
22 links- access.redhat.com/errata/RHSA-2018:0479Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
- access.redhat.com/errata/RHSA-2018:0481Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
- access.redhat.com/errata/RHSA-2018:1525Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
- access.redhat.com/errata/RHSA-2018:0480Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
www.debian.org/security/2018/dsa-4114Vendor AdvisoryX Refsource DEBIANThird Party AdvisoryAdvisoryWEB- access.redhat.com/errata/RHSA-2018:0478Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
- access.redhat.com/errata/RHSA-2019:2858Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
- access.redhat.com/errata/RHSA-2019:3149Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
- support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_usX Refsource CONFIRMThird Party AdvisoryAdvisoryWEB
Show all 22 references
- github.com/FasterXML/jackson-databind/issues/1899X Refsource MISCThird Party AdvisoryREPORTAdvisoryWEB
