Critical · published February 26, 2018
🚨 An incomplete fix could lead to a messy situation! This vulnerability allows unauthenticated remote code execution by sending malicious JSON to the ObjectMapper – think of it as a sneaky email that tricks your inbox into running the attachments! 🔥 Picture a postal service that unwittingly delivers packages without verifying the sender – if the sender knows just how to word the request, they can slip in something harmful without anyone checking the contents. An attacker can exploit this flaw to execute arbitrary code on the server, which is absolutely devastating! Imagine them waltzing right in, potentially hijacking sensitive data or altering critical processes without raising a single alarm. This could lead to catastrophe for any system relying on these outdated versions.
Picture a postal service that unwittingly delivers packages without verifying the sender – if the sender knows just how to word the request, they can slip in something harmful without anyone checking the contents. This vulnerability in FasterXML's jackson-databind allows remote code execution due to an ineffective blacklist while deserializing JSON input, especially with the c3p0 libraries present. Users can exploit the readValue method without any authentication.
An attacker can exploit this flaw to execute arbitrary code on the server, which is absolutely devastating! Imagine them waltzing right in, potentially hijacking sensitive data or altering critical processes without raising a single alarm. This could lead to catastrophe for any system relying on these outdated versions. To protect your environment, upgrade to jackson-databind version 2.7.9.3, 2.8.11.1, or 2.9.5 and ensure your libraries are up to date. Regularly audit your dependencies to prevent similar issues from arising in the future. You've got this! Implement the updates and keep your systems safe and secure. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| fasterxml/jackson-databind | < 2.7.9.3 | 2.7.9.3 |
| fasterxml/jackson-databind | ≥ 2.8.0, < 2.8.11.1 | 2.8.11.1 |
| fasterxml/jackson-databind | ≥ 2.9.0, < 2.9.5 | 2.9.5 |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| oracle/communications_billing_and_revenue_management | all versions | — |
| oracle/communications_instant_messaging_server | all versions | — |
| oracle/communications_billing_and_revenue_management | all versions | — |
| redhat/jboss_enterprise_application_platform | all versions | — |
| redhat/jboss_enterprise_application_platform | all versions | — |