CVE-2018-7489

    Dashboard / Vulnerabilities / CVE-2018-7489

    CVE-2018-7489

    Published: 26 Feb 2018Last Modified: 7 Aug 2026

    Summary:

    Details: FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.

    References: https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3E, https://www.oracle.com/security-alerts/cpuoct2020.html, http://www.securityfocus.com/bid/103203, http://www.securitytracker.com/id/1040693, http://www.securitytracker.com/id/1041890, https://access.redhat.com/errata/RHSA-2018:1447, https://access.redhat.com/errata/RHSA-2018:1448, https://access.redhat.com/errata/RHSA-2018:1449, https://access.redhat.com/errata/RHSA-2018:1450, https://access.redhat.com/errata/RHSA-2018:1451, https://access.redhat.com/errata/RHSA-2018:1786, https://access.redhat.com/errata/RHSA-2018:2088, https://access.redhat.com/errata/RHSA-2018:2089, https://access.redhat.com/errata/RHSA-2018:2090, https://access.redhat.com/errata/RHSA-2018:2938, https://access.redhat.com/errata/RHSA-2018:2939, https://access.redhat.com/errata/RHSA-2019:2858, https://access.redhat.com/errata/RHSA-2019:3149, https://github.com/FasterXML/jackson-databind/issues/1931, https://security.netapp.com/advisory/ntap-20180328-0001/, https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us, https://www.debian.org/security/2018/dsa-4190, http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html, http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html, http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html, https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html, https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html, https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -5cacb069a16653844e4c04c2a53578666080c1bb

    Affected versions

    jackson-databind-2.9.4
    jackson-databind-2.9.3
    jackson-databind-2.9.1
    jackson-databind-2.9.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High