CVE-2018-19362
CRITICAL
com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data
Published January 4, 2019Updated March 15, 2024Source: osv
Summary
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
Remediation
Upgrade to the fixed version using your package manager.
Maven
Update com.fasterxml.jackson.core:jackson-databind to 2.8.11.3 or later<!-- Update pom.xml dependency version to 2.8.11.3 for com.fasterxml.jackson.core:jackson-databind -->
Maven
Update com.fasterxml.jackson.core:jackson-databind to 2.7.9.5 or later<!-- Update pom.xml dependency version to 2.7.9.5 for com.fasterxml.jackson.core:jackson-databind -->
Maven
Update com.fasterxml.jackson.core:jackson-databind to 2.9.8 or later<!-- Update pom.xml dependency version to 2.9.8 for com.fasterxml.jackson.core:jackson-databind -->
Maven
Update com.fasterxml.jackson.core:jackson-databind to 2.6.7.3 or later<!-- Update pom.xml dependency version to 2.6.7.3 for com.fasterxml.jackson.core:jackson-databind -->
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (4)
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| com.fasterxml.jackson.core:jackson-databind | maven | 2.8.0, 2.8.1, 2.8.10, 2.8.11 (+11 more) | 2.8.11.3 |
| com.fasterxml.jackson.core:jackson-databind | maven | 2.7.0, 2.7.1, 2.7.1-1, 2.7.2 (+11 more) | 2.7.9.5 |
| com.fasterxml.jackson.core:jackson-databind | maven | 2.9.0, 2.9.0.pr1, 2.9.0.pr2, 2.9.0.pr3 (+8 more) | 2.9.8 |
| com.fasterxml.jackson.core:jackson-databind | maven | 2.0.0, 2.0.1, 2.0.2, 2.0.4 (+57 more) | 2.6.7.3 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-502Deserialization of Untrusted DataMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-19362ADVISORY
- https://github.com/FasterXML/jackson-databind/issues/2186WEB
- https://github.com/FasterXML/jackson-databind/commit/72cd4025a229fb28ec133235003dd4616f70afaaWEB
- https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2bWEB
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3EWEB
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3EWEB
- https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3EWEB
- https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c@%3Ccommits.pulsar.apache.org%3EWEB
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3EWEB
- https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3EWEB
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3EWEB
- https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3EWEB
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3EWEB
- https://lists.debian.org/debian-lts-announce/2019/03/msg00005.htmlWEB
- https://seclists.org/bugtraq/2019/May/68WEB
- https://security.netapp.com/advisory/ntap-20190530-0003WEB
- https://www.debian.org/security/2019/dsa-4452WEB
- https://www.oracle.com/security-alerts/cpuapr2020.htmlWEB
- https://www.oracle.com/security-alerts/cpujan2020.htmlWEB
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlWEB
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlWEB
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlWEB
- https://access.redhat.com/errata/RHBA-2019:0959WEB
- https://access.redhat.com/errata/RHSA-2019:0782WEB
- https://access.redhat.com/errata/RHSA-2019:0877WEB
- https://access.redhat.com/errata/RHSA-2019:1782WEB
- https://access.redhat.com/errata/RHSA-2019:1797WEB
- https://access.redhat.com/errata/RHSA-2019:1822WEB
- https://access.redhat.com/errata/RHSA-2019:1823WEB
- https://access.redhat.com/errata/RHSA-2019:2804WEB
- https://access.redhat.com/errata/RHSA-2019:2858WEB
- https://access.redhat.com/errata/RHSA-2019:3002WEB
- https://access.redhat.com/errata/RHSA-2019:3140WEB
- https://access.redhat.com/errata/RHSA-2019:3149WEB
- https://access.redhat.com/errata/RHSA-2019:3892WEB
- https://access.redhat.com/errata/RHSA-2019:4037WEB
- https://github.com/FasterXML/jackson-databindPACKAGE
- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8WEB
- https://github.com/advisories/GHSA-c8hm-7hpq-7jhgADVISORY
- https://issues.apache.org/jira/browse/TINKERPOP-2121WEB
- https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3@%3Cdevnull.infra.apache.org%3EWEB
- https://www.securityfocus.com/bid/107985WEB
Frequently Asked Questions
- What is CVE-2018-19362?
- com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2018-19362?
- CVE-2018-19362 affects com.fasterxml.jackson.core:jackson-databind. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2018-19362 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
9.8
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
GHSA-c8hm-7hpq-7jhg
Related CVEs
- CVE-2020-8840CRITICAL
Deserialization of Untrusted Data in jackson-databind
- CVE-2018-14718CRITICAL
Arbitrary Code Execution in jackson-databind
- CVE-2018-14721CRITICAL
Server-Side Request Forgery (SSRF) in jackson-databind
- CVE-2018-7489CRITICAL
FasterXML jackson-databind allows unauthenticated remote code execution
- CVE-2019-20330CRITICAL
Deserialization of Untrusted Data in jackson-databind
- CVE-2017-15095CRITICAL
jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution
- CVE-2026-54512HIGH
jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation
- CVE-2026-54513HIGH
jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies