CVE-2018-14721

Published: Jan 2, 2019Modified: Oct 15, 2026

10.0

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: NVD

Description

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.

Affected (41)

Products: Fasterxml: Jackson Databind · Debian: Debian Linux · Oracle: Banking Platform, Communications Billing And Revenue Management, Enterprise Manager For Virtualization, Financial Services Analytical Applications Infrastructure, Jdeveloper, Primavera Unifier, Retail Merchandising System, Webcenter Portal · +1 more

Show all products

Fasterxml: Jackson Databind · Debian: Debian Linux · Oracle: Banking Platform, Communications Billing And Revenue Management, Enterprise Manager For Virtualization, Financial Services Analytical Applications Infrastructure, Jdeveloper, Primavera Unifier, Retail Merchandising System, Webcenter Portal · Redhat: Jboss Enterprise Application Platform, Openshift Container Platform

1 product

1 product

8 products

Communications Billing And Revenue Management

Enterprise Manager For Virtualization

Financial Services Analytical Applications Infrastructure

Jdeveloper

Primavera Unifier

Retail Merchandising System

Webcenter Portal

Redhat

2 products

Jboss Enterprise Application Platform

Openshift Container Platform

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Fasterxml Jackson Databind	2.6.0 ≤ version < 2.6.7.2
Fasterxml Jackson Databind	2.7.0 ≤ version < 2.7.9.5
Fasterxml Jackson Databind	2.8.0 ≤ version < 2.8.11.3
Fasterxml Jackson Databind	2.9.0 ≤ version < 2.9.7
Fasterxml Jackson Databind	Version 2.7.0 rc1
Fasterxml Jackson Databind	Version 2.7.0 rc2
Fasterxml Jackson Databind	Version 2.7.0 rc3
Fasterxml Jackson Databind	Version 2.8.0 rc1
Fasterxml Jackson Databind	Version 2.8.0 rc2
Fasterxml Jackson Databind	Version 2.9.0 pr1
Fasterxml Jackson Databind	Version 2.9.0 pr2
Fasterxml Jackson Databind	Version 2.9.0 pr3
Fasterxml Jackson Databind	Version 2.9.0 pr4

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration C

24 vulnerable

Vulnerable Software	Affected Versions
Oracle Banking Platform	Version 2.5.0
Oracle Banking Platform	Version 2.6.0
Oracle Banking Platform	Version 2.6.1
Oracle Banking Platform	Version 2.6.2
Oracle Communications Billing And Revenue Management	Version 12.0
Oracle Communications Billing And Revenue Management	Version 7.5
Oracle Enterprise Manager For Virtualization	Version 13.2.2
Oracle Enterprise Manager For Virtualization	Version 13.2.3
Oracle Enterprise Manager For Virtualization	Version 13.3.1
Oracle Financial Services Analytical Applications Infrastructure	Version 8.0.2
Oracle Financial Services Analytical Applications Infrastructure	Version 8.0.3
Oracle Financial Services Analytical Applications Infrastructure	Version 8.0.4
Oracle Financial Services Analytical Applications Infrastructure	Version 8.0.5
Oracle Financial Services Analytical Applications Infrastructure	Version 8.0.6
Oracle Financial Services Analytical Applications Infrastructure	Version 8.0.7
Oracle Jdeveloper	Version 12.1.3.0.0
Oracle Jdeveloper	Version 12.2.1.3.0
Oracle Primavera Unifier	17.1 ≤ version ≤ 17.12
Oracle Primavera Unifier	Version 16.1
Oracle Primavera Unifier	Version 16.2
Oracle Primavera Unifier	Version 18.8
Oracle Retail Merchandising System	Version 15.0
Oracle Retail Merchandising System	Version 16.0
Oracle Webcenter Portal	Version 12.2.1.3.0

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Version 7.2.0
Redhat Openshift Container Platform	Version 3.11

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (58)

https://access.redhat.com/errata/RHBA-2019:0959

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:0782

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:1106

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:1107

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:1108

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:1140

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:1822

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:1823

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2858

Source: cve@mitre.org

https://access.redhat.com/errata/RHSA-2019:3149

Source: cve@mitre.org

https://access.redhat.com/errata/RHSA-2019:3892

Source: cve@mitre.org

https://access.redhat.com/errata/RHSA-2019:4037

Source: cve@mitre.org

https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/FasterXML/jackson-databind/issues/2097

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7

Source: cve@mitre.org

PatchRelease NotesThird Party Advisory

https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E

Source: cve@mitre.org

https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://seclists.org/bugtraq/2019/May/68

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20190530-0003/

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2019/dsa-4452

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: cve@mitre.org

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Source: cve@mitre.org

https://access.redhat.com/errata/RHBA-2019:0959