CVE-2018-11307
jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA. Más baja según Red Hat (alta), Ubuntu (media).
Descripción
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | com.fasterxml.jackson.core:jackson-databind | 2.7.9.4, 2.8.11.2, 2.9.6 |
| debian 11 | jackson-databind | 2.9.8-1 |
| debian 12 | jackson-databind | 2.9.8-1 |
| debian 13 | jackson-databind | 2.9.8-1 |
| debian 14 | jackson-databind | 2.9.8-1 |
| debian 8 | jackson-databind | 2.4.2-2+deb8u5 |
| debian 9 | jackson-databind | 2.8.6-1+deb9u5 |
| echo | jackson-databind | 2.9.8-1 |
| Red Hat | elasticsearch-cloud-kubernetes, openshift-elasticsearch-plugin | sin corrección indicada |
| ubuntu 16.04-ESM | jackson-databind | 2.4.2-3ubuntu0.1~esm2 |
Mostrar las 11 entradas de 10 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | com.fasterxml.jackson.core:jackson-databind | 2.7.9.4, 2.8.11.2, 2.9.6 |
| debian 11 | jackson-databind | 2.9.8-1 |
| debian 12 | jackson-databind | 2.9.8-1 |
| debian 13 | jackson-databind | 2.9.8-1 |
| debian 14 | jackson-databind | 2.9.8-1 |
| debian 8 | jackson-databind | 2.4.2-2+deb8u5 |
| debian 9 | jackson-databind | 2.8.6-1+deb9u5 |
| echo | jackson-databind | 2.9.8-1 |
| Red Hat | elasticsearch-cloud-kubernetes | sin corrección indicada |
| Red Hat | openshift-elasticsearch-plugin | sin corrección indicada |
| ubuntu 16.04-ESM | jackson-databind | 2.4.2-3ubuntu0.1~esm2 |
Referencias
- https://access.redhat.com/errata/RHSA-2019:0782
- https://access.redhat.com/errata/RHSA-2019:1822
- https://access.redhat.com/errata/RHSA-2019:1823
- https://access.redhat.com/errata/RHSA-2019:2804
- https://access.redhat.com/errata/RHSA-2019:2858
- https://access.redhat.com/errata/RHSA-2019:3002
- https://access.redhat.com/errata/RHSA-2019:3140
- https://access.redhat.com/errata/RHSA-2019:3149
Las 30 referencias
- https://access.redhat.com/errata/RHSA-2019:3892
- https://access.redhat.com/errata/RHSA-2019:4037
- https://access.redhat.com/security/cve/CVE-2018-11307
- https://github.com/FasterXML/jackson-databind
- https://github.com/FasterXML/jackson-databind/commit/051bd5e447fbc9539e12a4fe90eb989dba0c656
- https://github.com/FasterXML/jackson-databind/commit/27b4defc270454dea6842bd9279f17387eceb73
- https://github.com/FasterXML/jackson-databind/commit/27b4defc270454dea6842bd9279f17387eceb737
- https://github.com/FasterXML/jackson-databind/commit/78e78738d69adcb59fdac9fc12d9053ce8809f3d
- https://github.com/FasterXML/jackson-databind/issues/2032
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d@%3Cissues.lucene.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
- https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://nvd.nist.gov/vuln/detail/CVE-2017-7525
- https://nvd.nist.gov/vuln/detail/CVE-2018-11307
- https://ubuntu.com/security/notices/USN-4813-1
- https://www.cve.org/CVERecord?id=CVE-2018-11307
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html