We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
CVE ID: CVE-2018-12022 Description: An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload. CVSS Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P Discovery Date: 2019-05-30 Vendors: * oracle * fasterxml * fedoraproject References: * [RHSA-2019:1106] (https://access.redhat.com/errata/RHSA-2019:1106) * [RHSA-2019:0877] (https://access.redhat.com/errata/RHSA-2019:0877) * [https://github.com/FasterXML/jackson-databind/issues/2052] (FasterXML/jackson-databind#2052) * [https://bugzilla.redhat.com/show_bug.cgi?id=1671098] (https://bugzilla.redhat.com/show_bug.cgi?id=1671098) * [RHSA-2019:1108] (https://access.redhat.com/errata/RHSA-2019:1108) * [https://security.netapp.com/advisory/ntap-20190530-0003/] (https://security.netapp.com/advisory/ntap-20190530-0003/) * [https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf] (https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf) * [https://lists.fedoraproject.org/archives/list/[email protected]/message/ZEDLDUYBSTDY4GWDBUXGJNS2RFYTFVRC/] (https://lists.fedoraproject.org/archives/list/[email protected]/message/ZEDLDUYBSTDY4GWDBUXGJNS2RFYTFVRC/) * [RHSA-2019:1140] (https://access.redhat.com/errata/RHSA-2019:1140) * [RHBA-2019:0959] (https://access.redhat.com/errata/RHBA-2019:0959) * [RHSA-2019:1107] (https://access.redhat.com/errata/RHSA-2019:1107) * [DSA-4452] (https://www.debian.org/security/2019/dsa-4452) * [https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062] (https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062) * [https://github.com/FasterXML/jackson-databind/commit/28badf7ef60ac3e7ef151cd8e8ec010b8479226a] (FasterXML/jackson-databind@28badf7) * [https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html] (https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html) * [20190527 [SECURITY] [DSA 4452-1] jackson-databind security update] (https://seclists.org/bugtraq/2019/May/68) * [RHSA-2019:0782] (https://access.redhat.com/errata/RHSA-2019:0782)
The text was updated successfully, but these errors were encountered:
No branches or pull requests
CVE ID: CVE-2018-12022 Description: An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload. CVSS Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P Discovery Date: 2019-05-30 Vendors: * oracle * fasterxml * fedoraproject References: * [RHSA-2019:1106] (https://access.redhat.com/errata/RHSA-2019:1106) * [RHSA-2019:0877] (https://access.redhat.com/errata/RHSA-2019:0877) * [https://github.com/FasterXML/jackson-databind/issues/2052] (FasterXML/jackson-databind#2052) * [https://bugzilla.redhat.com/show_bug.cgi?id=1671098] (https://bugzilla.redhat.com/show_bug.cgi?id=1671098) * [RHSA-2019:1108] (https://access.redhat.com/errata/RHSA-2019:1108) * [https://security.netapp.com/advisory/ntap-20190530-0003/] (https://security.netapp.com/advisory/ntap-20190530-0003/) * [https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf] (https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf) * [https://lists.fedoraproject.org/archives/list/[email protected]/message/ZEDLDUYBSTDY4GWDBUXGJNS2RFYTFVRC/] (https://lists.fedoraproject.org/archives/list/[email protected]/message/ZEDLDUYBSTDY4GWDBUXGJNS2RFYTFVRC/) * [RHSA-2019:1140] (https://access.redhat.com/errata/RHSA-2019:1140) * [RHBA-2019:0959] (https://access.redhat.com/errata/RHBA-2019:0959) * [RHSA-2019:1107] (https://access.redhat.com/errata/RHSA-2019:1107) * [DSA-4452] (https://www.debian.org/security/2019/dsa-4452) * [https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062] (https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062) * [https://github.com/FasterXML/jackson-databind/commit/28badf7ef60ac3e7ef151cd8e8ec010b8479226a] (FasterXML/jackson-databind@28badf7) * [https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html] (https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html) * [20190527 [SECURITY] [DSA 4452-1] jackson-databind security update] (https://seclists.org/bugtraq/2019/May/68) * [RHSA-2019:0782] (https://access.redhat.com/errata/RHSA-2019:0782)
The text was updated successfully, but these errors were encountered: