CVE-2018-14718
CRITICAL
Arbitrary Code Execution in jackson-databind
Published January 4, 2019Updated March 16, 2024Source: osv
Summary
FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, 2.7.9.5, and 2.6.7.3 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
Remediation
Upgrade to the fixed version using your package manager.
Maven
Update com.fasterxml.jackson.core:jackson-databind to 2.8.11.3 or later<!-- Update pom.xml dependency version to 2.8.11.3 for com.fasterxml.jackson.core:jackson-databind -->
Maven
Update com.fasterxml.jackson.core:jackson-databind to 2.7.9.5 or later<!-- Update pom.xml dependency version to 2.7.9.5 for com.fasterxml.jackson.core:jackson-databind -->
Maven
Update com.fasterxml.jackson.core:jackson-databind to 2.9.7 or later<!-- Update pom.xml dependency version to 2.9.7 for com.fasterxml.jackson.core:jackson-databind -->
Maven
Update com.fasterxml.jackson.core:jackson-databind to 2.6.7.3 or later<!-- Update pom.xml dependency version to 2.6.7.3 for com.fasterxml.jackson.core:jackson-databind -->
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (4)
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| com.fasterxml.jackson.core:jackson-databind | maven | 2.8.0, 2.8.1, 2.8.10, 2.8.11 (+11 more) | 2.8.11.3 |
| com.fasterxml.jackson.core:jackson-databind | maven | 2.7.0, 2.7.1, 2.7.1-1, 2.7.2 (+11 more) | 2.7.9.5 |
| com.fasterxml.jackson.core:jackson-databind | maven | 2.9.0, 2.9.0.pr1, 2.9.0.pr2, 2.9.0.pr3 (+7 more) | 2.9.7 |
| com.fasterxml.jackson.core:jackson-databind | maven | 2.0.0, 2.0.1, 2.0.2, 2.0.4 (+57 more) | 2.6.7.3 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-502Deserialization of Untrusted DataMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-14718ADVISORY
- https://github.com/FasterXML/jackson-databind/issues/2097WEB
- https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44WEB
- https://access.redhat.com/errata/RHBA-2019:0959WEB
- https://lists.apache.org/thread.html/6a78f88716c3c57aa74ec05764a37ab3874769a347805903b393b286@%3Cdev.lucene.apache.org%3EWEB
- https://lists.apache.org/thread.html/82b01bfb6787097427ce97cec6a7127e93718bc05d1efd5eaffc228f@%3Cdev.lucene.apache.org%3EWEB
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3EWEB
- https://lists.apache.org/thread.html/ba973114605d936be276ee6ce09dfbdbf78aa56f6cdc6e79bfa7b8df@%3Cdev.lucene.apache.org%3EWEB
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3EWEB
- https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1@%3Ccommits.druid.apache.org%3EWEB
- https://lists.debian.org/debian-lts-announce/2019/03/msg00005.htmlWEB
- https://seclists.org/bugtraq/2019/May/68WEB
- https://security.netapp.com/advisory/ntap-20190530-0003WEB
- https://www.debian.org/security/2019/dsa-4452WEB
- https://www.oracle.com/security-alerts/cpuapr2020.htmlWEB
- https://www.oracle.com/security-alerts/cpujan2020.htmlWEB
- https://www.oracle.com/security-alerts/cpuoct2020.htmlWEB
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlWEB
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlWEB
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlWEB
- https://access.redhat.com/errata/RHSA-2019:0782WEB
- https://access.redhat.com/errata/RHSA-2019:0877WEB
- https://access.redhat.com/errata/RHSA-2019:1782WEB
- https://access.redhat.com/errata/RHSA-2019:1797WEB
- https://access.redhat.com/errata/RHSA-2019:1822WEB
- https://access.redhat.com/errata/RHSA-2019:1823WEB
- https://access.redhat.com/errata/RHSA-2019:2804WEB
- https://access.redhat.com/errata/RHSA-2019:2858WEB
- https://access.redhat.com/errata/RHSA-2019:3002WEB
- https://access.redhat.com/errata/RHSA-2019:3140WEB
- https://access.redhat.com/errata/RHSA-2019:3149WEB
- https://access.redhat.com/errata/RHSA-2019:3892WEB
- https://access.redhat.com/errata/RHSA-2019:4037WEB
- https://github.com/FasterXML/jackson-databindPACKAGE
- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7WEB
- https://github.com/advisories/GHSA-645p-88qh-w398ADVISORY
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3EWEB
- https://www.securityfocus.com/bid/106601WEB
Frequently Asked Questions
- What is CVE-2018-14718?
- Arbitrary Code Execution in jackson-databind This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2018-14718?
- CVE-2018-14718 affects com.fasterxml.jackson.core:jackson-databind. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2018-14718 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
9.8
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
GHSA-645p-88qh-w398
Related CVEs
- CVE-2020-8840CRITICAL
Deserialization of Untrusted Data in jackson-databind
- CVE-2018-14721CRITICAL
Server-Side Request Forgery (SSRF) in jackson-databind
- CVE-2018-19362CRITICAL
com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data
- CVE-2018-7489CRITICAL
FasterXML jackson-databind allows unauthenticated remote code execution
- CVE-2019-20330CRITICAL
Deserialization of Untrusted Data in jackson-databind
- CVE-2017-15095CRITICAL
jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution
- CVE-2026-54512HIGH
jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation
- CVE-2026-54513HIGH
jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies