9.8
CVSSv3

CVE-2018-14720

Published: 02/01/2019 Updated: 07/11/2023
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 668
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

FasterXML jackson-databind 2.x prior to 2.9.7 might allow malicious users to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

fasterxml jackson-databind 2.7.0

fasterxml jackson-databind

fasterxml jackson-databind 2.8.0

fasterxml jackson-databind 2.9.0

debian debian linux 8.0

debian debian linux 9.0

oracle primavera unifier 16.2

oracle banking platform 2.5.0

oracle primavera unifier 16.1

oracle jdeveloper 12.1.3.0.0

oracle retail merchandising system 16.0

oracle webcenter portal 12.2.1.3.0

oracle primavera unifier

oracle communications billing and revenue management 7.5

oracle communications billing and revenue management 12.0

oracle financial services analytical applications infrastructure 8.0.2

oracle financial services analytical applications infrastructure 8.0.3

oracle financial services analytical applications infrastructure 8.0.4

oracle financial services analytical applications infrastructure 8.0.5

oracle financial services analytical applications infrastructure 8.0.6

oracle financial services analytical applications infrastructure 8.0.7

oracle banking platform 2.6.0

oracle banking platform 2.6.1

oracle banking platform 2.6.2

oracle enterprise manager for virtualization 13.2.2

oracle enterprise manager for virtualization 13.2.3

oracle enterprise manager for virtualization 13.3.1

oracle primavera unifier 18.8

oracle jdeveloper 12.2.1.3.0

oracle retail merchandising system 15.0

redhat openshift container platform 3.11

redhat jboss enterprise application platform 7.2.0

Vendor Advisories

Multiple security issues were found in jackson-databind, a Java library to parse JSON and other data formats which could result in information disclosure or the execution of arbitrary code For the stable distribution (stretch), these problems have been fixed in version 286-1+deb9u5 We recommend that you upgrade your jackson-databind packages F ...
Synopsis Important: Red Hat Single Sign-On 731 security update Type/Severity Security Advisory: Important Topic A security update is now available for Red Hat Single Sign-On 73 from the Customer PortalRed Hat Product Security has rated this update as having a security impact of Important A Common Vulne ...
Synopsis Important: Red Hat JBoss Enterprise Application Platform 721 on RHEL 7 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application Platform 72 for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as ...
Synopsis Important: Red Hat JBoss Enterprise Application Platform 721 on RHEL 6 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application Platform 72 for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as ...
Synopsis Important: Red Hat JBoss Enterprise Application Platform 721 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application Platform 72 for Red Hat Enterprise LinuxRed Hat Product Security has rated this update as having a se ...
Synopsis Important: Red Hat Decision Manager 740 Security Update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat Decision ManagerRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) ba ...
Synopsis Important: Red Hat Data Grid 732 security update Type/Severity Security Advisory: Important Topic An update for Red Hat Data Grid is now availableRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, whic ...
Synopsis Important: rh-maven35-jackson-databind security update Type/Severity Security Advisory: Important Topic An update for rh-maven35-jackson-databind is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of Important A Common Vulne ...
Synopsis Important: Red Hat Process Automation Manager 740 Security Update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat Process Automation ManagerRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scor ...
Synopsis Important: EAP Continuous Delivery Technical Preview Release 16 security update Type/Severity Security Advisory: Important Topic This is a security update for JBoss EAP Continuous Delivery 160Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnera ...
Synopsis Important: OpenShift Container Platform logging-elasticsearch5-container security update Type/Severity Security Advisory: Important Topic An update for logging-elasticsearch5-container is now available for Red Hat OpenShift Container Platform 311Red Hat Product Security has rated this update as h ...
Synopsis Important: Red Hat Fuse 750 security update Type/Severity Security Advisory: Important Topic A minor version update (from 74 to 75) is now available for Red Hat Fuse The purpose of this text-only errata is to inform you about the security issues fixed in this releaseRed Hat Product Security h ...
Synopsis Important: OpenShift Container Platform 4118 logging-elasticsearch5 security update Type/Severity Security Advisory: Important Topic An update for logging-elasticsearch5-container is now available for Red Hat OpenShift Container Platform 41Red Hat Product Security has rated this update as havin ...
Multiple vulnerabilities have been found in Hitachi Infrastructure Analytics Advisor and Hitachi Compute Systems Manager CVE-2018-14720, CVE-2018-19360, CVE-2018-19361, CVE-2018-19362 Affected products and versions are listed below Please upgrade your version to the appropriate version ...

References

CWE-611CWE-502https://github.com/FasterXML/jackson-databind/issues/2097https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlhttps://lists.debian.org/debian-lts-announce/2019/03/msg00005.htmlhttps://access.redhat.com/errata/RHSA-2019:0782https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlhttps://access.redhat.com/errata/RHBA-2019:0959https://access.redhat.com/errata/RHSA-2019:1108https://access.redhat.com/errata/RHSA-2019:1107https://access.redhat.com/errata/RHSA-2019:1106https://access.redhat.com/errata/RHSA-2019:1140https://www.debian.org/security/2019/dsa-4452https://seclists.org/bugtraq/2019/May/68https://security.netapp.com/advisory/ntap-20190530-0003/https://access.redhat.com/errata/RHSA-2019:1823https://access.redhat.com/errata/RHSA-2019:1822https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlhttps://access.redhat.com/errata/RHSA-2019:2858https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlhttps://access.redhat.com/errata/RHSA-2019:3149https://access.redhat.com/errata/RHSA-2019:3892https://access.redhat.com/errata/RHSA-2019:4037https://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://lists.apache.org/thread.html/6a78f88716c3c57aa74ec05764a37ab3874769a347805903b393b286%40%3Cdev.lucene.apache.org%3Ehttps://lists.apache.org/thread.html/82b01bfb6787097427ce97cec6a7127e93718bc05d1efd5eaffc228f%40%3Cdev.lucene.apache.org%3Ehttps://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/ba973114605d936be276ee6ce09dfbdbf78aa56f6cdc6e79bfa7b8df%40%3Cdev.lucene.apache.org%3Ehttps://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3Ehttps://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3Ehttps://nvd.nist.govhttps://www.debian.org/security/2019/dsa-4452