CVE-2018-5968

moderate-risk
Published 2018-01-22

FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.

Do I need to act?

~
2.0% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.1/10 High
NETWORK / HIGH complexity

Affected Products (11)

Affected Vendors

Debian Redhat Netapp Fasterxml

References (24)

Third Party Advisory https://access.redhat.com/errata/RHSA-2018:0478
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:0479
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:0480
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:0481
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:1525
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:2858
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:3149
Third Party Advisory https://github.com/FasterXML/jackson-databind/issues/1899
Third Party Advisory https://security.netapp.com/advisory/ntap-20180423-0002/
Third Party Advisory https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpe...
Third Party Advisory https://www.debian.org/security/2018/dsa-4114
Third Party Advisory https://www.oracle.com/security-alerts/cpuoct2020.html
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:0478
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:0479
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:0480
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:0481
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:1525
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:2858
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:3149
Third Party Advisory https://github.com/FasterXML/jackson-databind/issues/1899
and 4 more references
45
/ 100
moderate-risk
Severity 24/34 · High
Exploitability 5/34 · Minimal
Exposure 16/34 · Moderate