Fix CVE–2018–11307

[debricked-staging]

CVE–2018–11307

Vulnerable dependency:     com.fasterxml.jackson.core:jackson-databind (Maven)    2.3.3

Vulnerability details

Description

Deserialization of Untrusted Data

The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

GitHub

Deserialization of Untrusted Data in jackson-databind

An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.

NVD

An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.

CVSS details - 9.8

 

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity	High
Availability	High

References

    Red Hat Customer Portal - Access to 24x7 support and knowledge
    Block one more gadget type (mybatis, CVE-2018-11307) · Issue #2032 · FasterXML/jackson-databind · GitHub
    NVD - CVE-2018-11307
    NVD - CVE-2017-7525
    On Jackson CVEs: Don’t Panic — Here is what you need to know | by @cowtowncoder | Medium
    Deserialization of Untrusted Data in jackson-databind · CVE-2018-11307 · GitHub Advisory Database · GitHub
    Red Hat Customer Portal - Access to 24x7 support and knowledge
    Red Hat Customer Portal - Access to 24x7 support and knowledge
    Red Hat Customer Portal - Access to 24x7 support and knowledge
    Red Hat Customer Portal - Access to 24x7 support and knowledge
    Red Hat Customer Portal - Access to 24x7 support and knowledge
    Red Hat Customer Portal - Access to 24x7 support and knowledge
    Red Hat Customer Portal - Access to 24x7 support and knowledge
    Red Hat Customer Portal - Access to 24x7 support and knowledge
    Red Hat Customer Portal - Access to 24x7 support and knowledge
    MLIST
    MLIST
    MLIST
    MLIST
    Oracle Critical Patch Update Advisory - April 2020
    Oracle Critical Patch Update Advisory - January 2020
    Oracle Critical Patch Update Advisory - October 2020
    Oracle Critical Patch Update Advisory - July 2019
    Issues · FasterXML/jackson-databind · GitHub

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE