CVE-2018-12023 - 漏洞详情

CVE-2018-12023 (CNNVD-201901-723)

HIGH

中文标题:

FasterXML jackson-databind 代码问题漏洞

英文标题:

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When De...

CVSS分数: 7.5

发布时间: 2019-03-17 17:57:52

漏洞类型: 代码问题

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

FasterXML Jackson是美国FasterXML公司的一款适用于Java的数据处理工具。jackson-databind是其中的一个具有数据绑定功能的组件。 FasterXML Jackson-databind 2.7.9.4之前版本、2.8.11.2之前版本和2.9.6之前版本中存在代码问题漏洞。远程攻击者可利用该漏洞在受影响应用程序的上下文中执行任意代码或造成拒绝服务。

英文描述:

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.

CWE类型:

CWE-502

受影响产品

厂商	产品	版本	版本范围	平台	CPE
fasterxml	jackson-databind	*	-	-	`cpe:2.3:a:fasterxml:jackson-databind::::::::`
debian	debian_linux	9.0	-	-	`cpe:2.3:o:debian:debian_linux:9.0:::::::*`
fedoraproject	fedora	29	-	-	`cpe:2.3:o:fedoraproject:fedora:29:::::::*`
oracle	jd_edwards_enterpriseone_tools	9.2	-	-	`cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:::::::*`
oracle	retail_merchandising_system	15.0	-	-	`cpe:2.3:a:oracle:retail_merchandising_system:15.0:::::::*`
redhat	automation_manager	7.3.1	-	-	`cpe:2.3:a:redhat:automation_manager:7.3.1:::::::*`
redhat	decision_manager	7.3.1	-	-	`cpe:2.3:a:redhat:decision_manager:7.3.1:::::::*`
redhat	jboss_brms	6.4.10	-	-	`cpe:2.3:a:redhat:jboss_brms:6.4.10:::::::*`
redhat	jboss_enterprise_application_platform	7.2.0	-	-	`cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:::::::*`
redhat	openshift_container_platform	3.11	-	-	`cpe:2.3:a:redhat:openshift_container_platform:3.11:::::::*`
redhat	single_sign-on	7.3	-	-	`cpe:2.3:a:redhat:single_sign-on:7.3:::::::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

RHSA-2019:0782 vendor-advisory
cve.org

访问

RHSA-2019:0877 vendor-advisory
cve.org

访问

RHBA-2019:0959 vendor-advisory
cve.org

访问

RHSA-2019:1107 vendor-advisory
cve.org

访问

RHSA-2019:1108 vendor-advisory
cve.org

访问

RHSA-2019:1106 vendor-advisory
cve.org

访问

RHSA-2019:1140 vendor-advisory
cve.org

访问

DSA-4452 vendor-advisory
cve.org

访问

20190527 [SECURITY] [DSA 4452-1] jackson-databind security update mailing-list
cve.org

访问

RHSA-2019:1782 vendor-advisory
cve.org

访问

RHSA-2019:1797 vendor-advisory
cve.org

访问

RHSA-2019:1822 vendor-advisory
cve.org

访问

RHSA-2019:1823 vendor-advisory
cve.org

访问

RHSA-2019:2804 vendor-advisory
cve.org

访问

RHSA-2019:2858 vendor-advisory
cve.org

访问

[lucene-issues] 20191004 [GitHub] [lucene-solr] marungo opened a new pull request #925: SOLR-13818: Upgrade jackson to 2.10.0 mailing-list
cve.org

访问

RHSA-2019:3002 vendor-advisory
cve.org

访问

RHSA-2019:3140 vendor-advisory
cve.org

访问

[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
cve.org

访问

RHSA-2019:3149 vendor-advisory
cve.org

访问

[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
cve.org

访问

[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
cve.org

访问

RHSA-2019:3892 vendor-advisory
cve.org

访问

RHSA-2019:4037 vendor-advisory
cve.org

访问