CVE-2018-14721: SSRF
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.8-3+deb10u3Fixed in 2.9.8-3+deb10u5Fixed in 2.12.1-1+deb11u1Fixed in 2.14.0-1 - Upgrade
Upgrade
redhat/jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.7 - Upgrade
Upgrade
redhat/jackson-databindto a version that resolves this vulnerability.Fixed in 2.7.9.5 - Upgrade
Upgrade
redhat/jackson-databindto a version that resolves this vulnerability.Fixed in 2.8.11.3 - Upgrade
Upgrade
FasterXML jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.7
Event History
Frequently Asked Questions
What is the vulnerability ID of this security flaw?
The vulnerability ID is CVE-2018-14721.
What is the severity rating of CVE-2018-14721?
CVE-2018-14721 has a severity rating of medium (5.3).
Which software versions are affected by CVE-2018-14721?
Versions up to and exclusive of 2.9.7, 2.7.9.5, 2.8.11.3, 2.9.8-3+deb10u3, 2.9.8-3+deb10u5, 2.12.1-1+deb11u1, and 2.14.0-1 of jackson-databind are affected by CVE-2018-14721.
What is the risk associated with CVE-2018-14721?
CVE-2018-14721 allows remote attackers to conduct server-side request forgery and potentially obtain sensitive data.
How can I fix CVE-2018-14721?
To fix CVE-2018-14721, update jackson-databind to version 2.9.7 or apply the provided patches from the official GitHub repository.