← Back

CVE-2018-5968

nvd nist
Published: Jan 22, 2018Modified: Jun 17, 2026

JSON object

Loading...
8.1
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.2 / Impact: 5.9
Source: NVD

Description

FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.

Affected (14)

Show all products
Fasterxml: Jackson Databind · Debian: Debian Linux · Redhat: Openshift Container Platform, Virtualization, Virtualization Host, Jboss Enterprise Application Platform · Netapp: E Series Santricity Os Controller, E Series Santricity Web Services Proxy, Oncommand Shift
Fasterxml
1 product
Jackson Databind
Debian
1 product
Debian Linux
Redhat
4 products
Openshift Container Platform
Virtualization
Virtualization Host
Jboss Enterprise Application Platform
Netapp
3 products
E Series Santricity Os Controller
E Series Santricity Web Services Proxy
Oncommand Shift
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Fasterxml
Jackson Databind
From 2.0.0 to 2.6.7.3
Jackson Databind
From 2.7.0 to 2.7.9.2
Jackson Databind
From 2.8.0 to 2.8.11.1
Jackson Databind
From 2.9.0 to 2.9.4
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Debian
Debian Linux
Version 8.0
Debian Linux
Version 9.0
Configuration C
3 vulnerable
Vulnerable SoftwareAffected Versions
Openshift Container Platform
Version 4.1
Virtualization
Version 4.0
Virtualization Host
Version 4.0
Configuration D
1 vulnerable · 2 platform
Vulnerable SoftwareAffected Versions
Jboss Enterprise Application Platform
Version 7.1
Running on/withPlatform Versions
Redhat
Enterprise Linux Server
Version 6.0
Redhat
Enterprise Linux Server
Version 7.0
Configuration E
1 vulnerable
Vulnerable SoftwareAffected Versions
Openshift Container Platform
Version 3.11
Configuration F
3 vulnerable
Vulnerable SoftwareAffected Versions
E Series Santricity Os Controller
From 11.0.0 to 11.60.3
E Series Santricity Web Services Proxy
All versions
Oncommand Shift
All versions

Related CWEs

CWE-184
Incomplete List of Disallowed Inputs
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses.
CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (24)

Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.