7.5
CVSSv2

CVE-2018-19360

Published: 02/01/2019 Updated: 07/11/2023
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 668
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

FasterXML jackson-databind 2.x prior to 2.9.8 might allow malicious users to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

fasterxml jackson-databind

debian debian linux 8.0

oracle primavera unifier 16.2

oracle primavera p6 enterprise project portfolio management 16.2

oracle primavera p6 enterprise project portfolio management 15.1

oracle primavera unifier 16.1

oracle primavera p6 enterprise project portfolio management 16.1

oracle primavera p6 enterprise project portfolio management 15.2

oracle webcenter portal 12.2.1.3.0

oracle business process management suite 12.1.3.0.0

oracle business process management suite 12.2.1.3.0

oracle primavera p6 enterprise project portfolio management

oracle primavera p6 enterprise project portfolio management 18.8

oracle primavera unifier 18.8

oracle retail workforce management software 1.60.9.0.0

oracle primavera unifier

redhat openshift container platform 3.11

redhat jboss bpm suite 6.4.11

redhat jboss brms 6.4.10

redhat automation manager 7.3.1

redhat decision manager 7.3.1

Vendor Advisories

Multiple security issues were found in jackson-databind, a Java library to parse JSON and other data formats which could result in information disclosure or the execution of arbitrary code For the stable distribution (stretch), these problems have been fixed in version 286-1+deb9u5 We recommend that you upgrade your jackson-databind packages F ...
Synopsis Important: Red Hat FIS 20 on Fuse 630 R13 security and bug fix update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat Fuse Integration ServicesRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability ...
Synopsis Important: Red Hat Decision Manager 740 Security Update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat Decision ManagerRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) ba ...
Synopsis Important: Red Hat Data Grid 732 security update Type/Severity Security Advisory: Important Topic An update for Red Hat Data Grid is now availableRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, whic ...
Synopsis Important: Red Hat JBoss Data Virtualization 648 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Data VirtualizationRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scorin ...
Synopsis Important: rh-maven35-jackson-databind security update Type/Severity Security Advisory: Important Topic An update for rh-maven35-jackson-databind is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of Important A Common Vulne ...
Synopsis Important: Red Hat JBoss BRMS 6412 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss BRMSRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, w ...
Synopsis Important: Red Hat Process Automation Manager 740 Security Update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat Process Automation ManagerRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scor ...
Synopsis Important: EAP Continuous Delivery Technical Preview Release 16 security update Type/Severity Security Advisory: Important Topic This is a security update for JBoss EAP Continuous Delivery 160Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnera ...
Synopsis Important: OpenShift Container Platform logging-elasticsearch5-container security update Type/Severity Security Advisory: Important Topic An update for logging-elasticsearch5-container is now available for Red Hat OpenShift Container Platform 311Red Hat Product Security has rated this update as h ...
Synopsis Important: Red Hat Fuse 750 security update Type/Severity Security Advisory: Important Topic A minor version update (from 74 to 75) is now available for Red Hat Fuse The purpose of this text-only errata is to inform you about the security issues fixed in this releaseRed Hat Product Security h ...
Synopsis Important: Red Hat OpenShift Application Runtimes Thorntail 240 security & bug fix update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat OpenShift Application RuntimesRed Hat Product Security has rated this update as having a security impact of Import ...
Synopsis Important: Red Hat JBoss BPM Suite 6412 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss BPM SuiteRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) bas ...
Synopsis Important: Red Hat JBoss Fuse/A-MQ 63 R13 security and bug fix update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Fuse 63 and Red Hat JBoss A-MQ 63Red Hat Product Security has rated this update as having a security impact of Important A Common ...
Synopsis Important: OpenShift Container Platform 4118 logging-elasticsearch5 security update Type/Severity Security Advisory: Important Topic An update for logging-elasticsearch5-container is now available for Red Hat OpenShift Container Platform 41Red Hat Product Security has rated this update as havin ...
Multiple vulnerabilities have been found in Hitachi Infrastructure Analytics Advisor and Hitachi Compute Systems Manager CVE-2018-14720, CVE-2018-19360, CVE-2018-19361, CVE-2018-19362 Affected products and versions are listed below Please upgrade your version to the appropriate version ...

Github Repositories

Disclaimer Notwithstanding anything that may be contained to the contrary in your agreement(s) with Sysdig, Sysdig provides no support, no updates, and no warranty or guarantee of any kind with respect to these script(s), including as to their functionality or their ability to work in your environment(s) Sysdig disclaims all liability and responsibility with respect to any us

References

CWE-502https://issues.apache.org/jira/browse/TINKERPOP-2121https://github.com/FasterXML/jackson-databind/issues/2186https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2bhttps://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8https://lists.debian.org/debian-lts-announce/2019/03/msg00005.htmlhttps://access.redhat.com/errata/RHSA-2019:0782https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlhttps://access.redhat.com/errata/RHSA-2019:0877https://access.redhat.com/errata/RHBA-2019:0959https://www.debian.org/security/2019/dsa-4452https://seclists.org/bugtraq/2019/May/68https://security.netapp.com/advisory/ntap-20190530-0003/https://access.redhat.com/errata/RHSA-2019:1782https://access.redhat.com/errata/RHSA-2019:1797http://www.securityfocus.com/bid/107985https://access.redhat.com/errata/RHSA-2019:1823https://access.redhat.com/errata/RHSA-2019:1822https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlhttps://access.redhat.com/errata/RHSA-2019:2804https://access.redhat.com/errata/RHSA-2019:2858https://access.redhat.com/errata/RHSA-2019:3002https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlhttps://access.redhat.com/errata/RHSA-2019:3140https://access.redhat.com/errata/RHSA-2019:3149https://access.redhat.com/errata/RHSA-2019:3892https://access.redhat.com/errata/RHSA-2019:4037https://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3%40%3Cdevnull.infra.apache.org%3Ehttps://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3Ehttps://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3Ehttps://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3Ehttps://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3Ehttps://nvd.nist.govhttps://www.debian.org/security/2019/dsa-4452