CVE-2018-12022 - 漏洞详情

CVE-2018-12022 (CNNVD-201902-747)

HIGH

中文标题:

FasterXML jackson-databind 代码问题漏洞

英文标题:

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When De...

CVSS分数: 7.5

发布时间: 2019-03-17 18:14:21

漏洞类型: 代码问题

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

FasterXML Jackson是美国FasterXML公司的一款适用于Java的数据处理工具。jackson-databind是其中的一个具有数据绑定功能的组件。 FasterXML jackson-databind 2.7.9.4之前版本、2.8.11.2之前版本和2.9.6之前版本中存在安全漏洞。远程攻击者可利用该漏洞执行执行代码。

英文描述:

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.

CWE类型:

CWE-502

受影响产品

厂商	产品	版本	版本范围	平台	CPE
fasterxml	jackson-databind	*	-	-	`cpe:2.3:a:fasterxml:jackson-databind::::::::`
debian	debian_linux	9.0	-	-	`cpe:2.3:o:debian:debian_linux:9.0:::::::*`
fedoraproject	fedora	29	-	-	`cpe:2.3:o:fedoraproject:fedora:29:::::::*`
oracle	jd_edwards_enterpriseone_tools	9.2	-	-	`cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:::::::*`
oracle	retail_merchandising_system	15.0	-	-	`cpe:2.3:a:oracle:retail_merchandising_system:15.0:::::::*`
redhat	automation_manager	7.3.1	-	-	`cpe:2.3:a:redhat:automation_manager:7.3.1:::::::*`
redhat	decision_manager	7.3.1	-	-	`cpe:2.3:a:redhat:decision_manager:7.3.1:::::::*`
redhat	jboss_brms	6.4.10	-	-	`cpe:2.3:a:redhat:jboss_brms:6.4.10:::::::*`
redhat	jboss_enterprise_application_platform	7.2.0	-	-	`cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:::::::*`
redhat	openshift_container_platform	3.11	-	-	`cpe:2.3:a:redhat:openshift_container_platform:3.11:::::::*`
redhat	single_sign-on	7.3	-	-	`cpe:2.3:a:redhat:single_sign-on:7.3:::::::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

RHSA-2019:0782 vendor-advisory
cve.org

访问

RHSA-2019:0877 vendor-advisory
cve.org

访问

RHBA-2019:0959 vendor-advisory
cve.org

访问

RHSA-2019:1107 vendor-advisory
cve.org

访问

RHSA-2019:1108 vendor-advisory
cve.org

访问

RHSA-2019:1106 vendor-advisory
cve.org

访问

RHSA-2019:1140 vendor-advisory
cve.org

访问

DSA-4452 vendor-advisory
cve.org

访问

20190527 [SECURITY] [DSA 4452-1] jackson-databind security update mailing-list
cve.org

访问

RHSA-2019:1782 vendor-advisory
cve.org

访问

RHSA-2019:1797 vendor-advisory
cve.org

访问

107585 vdb-entry
cve.org

访问

RHSA-2019:1822 vendor-advisory
cve.org

访问

RHSA-2019:1823 vendor-advisory
cve.org

访问

RHSA-2019:2804 vendor-advisory
cve.org

访问

RHSA-2019:2858 vendor-advisory
cve.org

访问

[lucene-issues] 20191004 [GitHub] [lucene-solr] marungo opened a new pull request #925: SOLR-13818: Upgrade jackson to 2.10.0 mailing-list
cve.org

访问

RHSA-2019:3002 vendor-advisory
cve.org

访问

RHSA-2019:3140 vendor-advisory
cve.org

访问

[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
cve.org

访问

RHSA-2019:3149 vendor-advisory
cve.org

访问

[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
cve.org

访问

[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
cve.org

访问

RHSA-2019:3892 vendor-advisory
cve.org

访问

RHSA-2019:4037 vendor-advisory
cve.org

访问