Critical · published January 2, 2019
⚡ A sneaky oversight in FasterXML's jackson-databind could let attackers pull off remote code execution without breaking a sweat! 🔥 Think of it like a restaurant that allows unverified guests into the kitchen — anyone can whip up a dish, or in this case, run malicious code, because there’s no check at the door! An attacker could exploit this flaw to execute arbitrary code on your systems, potentially compromising your entire application. Imagine someone gaining full control and wreaking havoc, all because security checks were overlooked. This could lead to data breaches or service disruptions that you absolutely want to avoid!
Think of it like a restaurant that allows unverified guests into the kitchen — anyone can whip up a dish, or in this case, run malicious code, because there’s no check at the door! CVE-2018-14718 arises from the failure to block the slf4j-ext class during polymorphic deserialization in versions of jackson-databind before 2.9.7, enabling attackers to execute malicious code remotely.
An attacker could exploit this flaw to execute arbitrary code on your systems, potentially compromising your entire application. Imagine someone gaining full control and wreaking havoc, all because security checks were overlooked. This could lead to data breaches or service disruptions that you absolutely want to avoid! Upgrade jackson-databind to version 2.9.7 or later immediately to fix this vulnerability. Also, consider reviewing your deserialization practices to ensure that only trusted classes are processed. Implementing security measures like input validation can also help bolster your defenses! You've got this! Take action now, and you’ll be well on your way to keeping your systems secure. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| fasterxml/jackson-databind | ≥ 2.0.0, < 2.6.7.3 | 2.6.7.3 |
| fasterxml/jackson-databind | ≥ 2.7.0, < 2.7.9.5 | 2.7.9.5 |
| fasterxml/jackson-databind | ≥ 2.8.0, < 2.8.11.3 | 2.8.11.3 |
| fasterxml/jackson-databind | ≥ 2.9.0, < 2.9.7 | 2.9.7 |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/business_process_management_suite | all versions | — |
| oracle/business_process_management_suite | all versions | — |
| oracle/communications_billing_and_revenue_management | all versions | — |
| oracle/communications_billing_and_revenue_management | all versions | — |
| oracle/communications_instant_messaging_server | all versions | — |
| oracle/enterprise_manager_for_virtualization | all versions | — |
| oracle/enterprise_manager_for_virtualization | all versions | — |
| oracle/enterprise_manager_for_virtualization | all versions | — |
| oracle/financial_services_analytical_applications_infrastructure | all versions | — |
| oracle/financial_services_analytical_applications_infrastructure | all versions | — |
| oracle/financial_services_analytical_applications_infrastructure | all versions | — |
| oracle/financial_services_analytical_applications_infrastructure | all versions | — |
| oracle/financial_services_analytical_applications_infrastructure | all versions | — |
| oracle/financial_services_analytical_applications_infrastructure | all versions | — |
| oracle/global_lifecycle_management_opatch | < 11.2.0.3.23 | 11.2.0.3.23 |
| oracle/global_lifecycle_management_opatch | ≥ 12.2.0.1.0, < 12.2.0.1.19 | 12.2.0.1.19 |
| oracle/global_lifecycle_management_opatch | ≥ 13.9.4.0.0, < 13.9.4.2.1 | 13.9.4.2.1 |
| oracle/jd_edwards_enterpriseone_orchestrator | all versions | — |
| oracle/jd_edwards_enterpriseone_tools | all versions | — |
| oracle/jdeveloper | all versions | — |
| oracle/jdeveloper | all versions | — |
| oracle/nosql_database | < 19.3.12 | 19.3.12 |
| oracle/nosql_database | all versions | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | ≥ 17.7, ≤ 17.12 | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | all versions | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | all versions | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | all versions | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | all versions | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | all versions | — |
| oracle/primavera_unifier | ≥ 17.7, ≤ 17.12 | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/retail_customer_management_and_segmentation_foundation | all versions | — |
| oracle/retail_merchandising_system | all versions | — |
| oracle/retail_merchandising_system | all versions | — |
| oracle/retail_workforce_management_software | all versions | — |
| oracle/siebel_engineering_-_installer_\&_deployment | ≤ 19.8 | — |
| oracle/siebel_ui_framework | ≤ 19.10 | — |
| oracle/webcenter_portal | all versions | — |
| netapp/oncommand_workflow_automation | all versions | — |
| netapp/snapcenter | all versions | — |
| netapp/steelstore_cloud_integrated_storage | all versions | — |
| redhat/openshift_container_platform | ≥ 3.11, < 3.11.153 | 3.11.153 |
| redhat/openshift_container_platform | ≥ 4.6, < 4.6.26 | 4.6.26 |
| redhat/openshift_container_platform | all versions | — |
| redhat/openshift_container_platform | ≥ 4.1, < 4.1.18 | 4.1.18 |