CVE-2018-7489
CRITICAL
FasterXML jackson-databind allows unauthenticated remote code execution
Published October 16, 2018Updated March 15, 2024Source: osv
Summary
FasterXML jackson-databind before before 2.6.7.5, 2.7.x before 2.7.9.3, 2.8.x before 2.8.11.1, and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.
Remediation
Upgrade to the fixed version using your package manager.
Maven
Update com.fasterxml.jackson.core:jackson-databind to 2.8.11.1 or later<!-- Update pom.xml dependency version to 2.8.11.1 for com.fasterxml.jackson.core:jackson-databind -->
Maven
Update com.fasterxml.jackson.core:jackson-databind to 2.9.5 or later<!-- Update pom.xml dependency version to 2.9.5 for com.fasterxml.jackson.core:jackson-databind -->
Maven
Update com.fasterxml.jackson.core:jackson-databind to 2.7.9.3 or later<!-- Update pom.xml dependency version to 2.7.9.3 for com.fasterxml.jackson.core:jackson-databind -->
Maven
Update com.fasterxml.jackson.core:jackson-databind to 2.6.7.5 or later<!-- Update pom.xml dependency version to 2.6.7.5 for com.fasterxml.jackson.core:jackson-databind -->
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (4)
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| com.fasterxml.jackson.core:jackson-databind | maven | 2.8.0, 2.8.1, 2.8.10, 2.8.11 (+9 more) | 2.8.11.1 |
| com.fasterxml.jackson.core:jackson-databind | maven | 2.9.0, 2.9.0.pr1, 2.9.0.pr2, 2.9.0.pr3 (+5 more) | 2.9.5 |
| com.fasterxml.jackson.core:jackson-databind | maven | 2.7.0, 2.7.1, 2.7.1-1, 2.7.2 (+9 more) | 2.7.9.3 |
| com.fasterxml.jackson.core:jackson-databind | maven | 2.0.0, 2.0.0-RC1, 2.0.0-RC2, 2.0.0-RC3 (+62 more) | 2.6.7.5 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-184
- CWE-502Deserialization of Untrusted DataMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-7489ADVISORY
- https://github.com/FasterXML/jackson-databind/issues/1931WEB
- https://github.com/FasterXML/jackson-databind/commit/e66c0a9d3c926ff1b63bf586c824ead1d02f2a3dWEB
- https://github.com/FasterXML/jackson-databind/commit/ca2bfc86af82a1479112004b663ba74c760752e6WEB
- https://github.com/FasterXML/jackson-databind/commit/c921f0935d5e41bf206e702d8077a275ba1a6efcWEB
- https://github.com/FasterXML/jackson-databind/commit/6799f8f10cc78e9af6d443ed6982d00a13f2e7d2WEB
- https://github.com/FasterXML/jackson-databind/commit/bc22f90eb7f896ace9567598a99cb1ff6e0f9d9dWEB
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlWEB
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlWEB
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlWEB
- https://www.oracle.com/security-alerts/cpuoct2020.htmlWEB
- https://www.debian.org/security/2018/dsa-4190WEB
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_usWEB
- https://security.netapp.com/advisory/ntap-20180328-0001WEB
- https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1@%3Ccommits.druid.apache.org%3EWEB
- https://github.com/advisories/GHSA-cggj-fvv3-cqwvADVISORY
- https://github.com/FasterXML/jackson-databindPACKAGE
- https://access.redhat.com/errata/RHSA-2019:3149WEB
- https://access.redhat.com/errata/RHSA-2019:2858WEB
- https://access.redhat.com/errata/RHSA-2018:2939WEB
- https://access.redhat.com/errata/RHSA-2018:2938WEB
- https://access.redhat.com/errata/RHSA-2018:2090WEB
- https://access.redhat.com/errata/RHSA-2018:2089WEB
- https://access.redhat.com/errata/RHSA-2018:2088WEB
- https://access.redhat.com/errata/RHSA-2018:1786WEB
- https://access.redhat.com/errata/RHSA-2018:1451WEB
- https://access.redhat.com/errata/RHSA-2018:1450WEB
- https://access.redhat.com/errata/RHSA-2018:1449WEB
- https://access.redhat.com/errata/RHSA-2018:1448WEB
- https://access.redhat.com/errata/RHSA-2018:1447WEB
- https://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlWEB
- https://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlWEB
- https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlWEB
Frequently Asked Questions
- What is CVE-2018-7489?
- FasterXML jackson-databind allows unauthenticated remote code execution This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2018-7489?
- CVE-2018-7489 affects com.fasterxml.jackson.core:jackson-databind. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2018-7489 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
9.8
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
GHSA-cggj-fvv3-cqwv
Related CVEs
- CVE-2020-8840CRITICAL
Deserialization of Untrusted Data in jackson-databind
- CVE-2018-14718CRITICAL
Arbitrary Code Execution in jackson-databind
- CVE-2018-14721CRITICAL
Server-Side Request Forgery (SSRF) in jackson-databind
- CVE-2018-19362CRITICAL
com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data
- CVE-2019-20330CRITICAL
Deserialization of Untrusted Data in jackson-databind
- CVE-2017-15095CRITICAL
jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution
- CVE-2026-54512HIGH
jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation
- CVE-2026-54513HIGH
jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies