CVE-2018-12023: High severity fasterxml jackson-databind vulnerability
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
Other sources
FasterXML jackson-databind before versions 2.7.9.4, 2.8.11.2, 2.9.6 fails to block polymorphic deserialization of types from Oracle JDBC driver. This could lead to Remote Code Execution.
Reference: https://github.com/FasterXML/jackson-databind/issues/2058
Upstream Patch: https://github.com/FasterXML/jackson-databind/commit/7487cf7eb14be2f65a1eb108e8629c07ef45e0a1
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.8-3+deb10u3Fixed in 2.9.8-3+deb10u5Fixed in 2.12.1-1+deb11u1Fixed in 2.14.0-1 - Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.6 - Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.8.11.2 - Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.7.9.4 - Upgrade
Upgrade
redhat/jackson-databindto a version that resolves this vulnerability.Fixed in 2.7.9.4 - Upgrade
Upgrade
redhat/jackson-databindto a version that resolves this vulnerability.Fixed in 2.8.11.2 - Upgrade
Upgrade
redhat/jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.6 - Upgrade
Upgrade
FasterXML jackson-databindto a version that resolves this vulnerability.Fixed in 2.7.9.4 - Upgrade
Upgrade
FasterXML jackson-databindto a version that resolves this vulnerability.Fixed in 2.8.11.2 - Upgrade
Upgrade
FasterXML jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.6 - Configuration
If Default Typing is enabled (globally or for a specific property), disable it to prevent polymorphic deserialization that can leverage the Oracle JDBC jar in the classpath and enable LDAP-based payload execution.
FasterXML jackson-databind Default Typing = disable when not required (globally or for specific properties)
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2018-12023.
What is the severity level of CVE-2018-12023?
CVE-2018-12023 has a severity level of 8.1 (High).
Which products are affected by CVE-2018-12023?
CVE-2018-12023 affects multiple Oracle products and IBM Disconnected Log Collector.
What is the affected version of jackson-databind?
The affected versions of jackson-databind are 2.7.9.4, 2.8.11.2, and 2.9.6.
Are there any remediation steps available?
Yes, there are remediation steps available for jackson-databind. Please refer to the official sources for specific remediation steps.