CVE-2018-19361
Fixed in a distro release EPSS 11%
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
Products: FasterXML jackson-databind, debian_linux, oracle business_process_management_suite, oracle primavera_p6_enterprise_project_portfolio_management, oracle primavera_unifier, oracle retail_workforce_management_software, oracle webcenter_portal, redhat automation_manager, redhat decision_manager, redhat jboss_bpm_suite, redhat jboss_brms, redhat openshift_container_platform
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | com.fasterxml.jackson.core:jackson-databind | 2.7.9.5 |
| Maven | com.fasterxml.jackson.core:jackson-databind | 2.9.8 |
| Maven | com.fasterxml.jackson.core:jackson-databind | 2.8.11.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | eco-java-gradle-4.10 | no fix |
| Chainguard | eco-java-gradle-4.10.1 | no fix |
| Chainguard | eco-java-gradle-4.10.2 | no fix |
| Chainguard | eco-java-gradle-4.10.3 | no fix |
| Chainguard | eco-java-gradle-4.4 | no fix |
| Chainguard | eco-java-gradle-4.4.1 | no fix |
| Chainguard | eco-java-gradle-4.5 | no fix |
| Chainguard | eco-java-gradle-4.5.1 | no fix |
| Chainguard | eco-java-gradle-4.6 | no fix |
| Chainguard | eco-java-gradle-4.7 | no fix |
| Chainguard | eco-java-gradle-4.8 | no fix |
| Chainguard | eco-java-gradle-4.8.1 | no fix |
| Chainguard | eco-java-gradle-4.9 | no fix |
| Chainguard | eco-java-gradle-5.0 | no fix |
| Chainguard | eco-java-gradle-5.1 | no fix |
| Chainguard | eco-java-gradle-5.1.1 | no fix |
| Chainguard | eco-java-gradle-5.2 | no fix |
| Chainguard | eco-java-gradle-5.2.1 | no fix |
| Debian 12 | jackson-databind | 2.9.8-1 |
| Debian 13 | jackson-databind | 2.9.8-1 |
| Debian 14 | jackson-databind | 2.9.8-1 |
| Debian 8 | jackson-databind | 2.4.2-2+deb8u5 |
| Debian 9 | jackson-databind | 2.8.6-1+deb9u5 |
| Red Hat rhel software collections 3 | rh-maven35-jackson-databind | 0:2.7.6-2.5.el7 |
| Red Hat rhel software collections 3 | rh-maven35-jackson-databind-javadoc | 0:2.7.6-2.5.el7 |
| Ubuntu Pro 14.04 LTS | jackson-databind | no fix |
| Ubuntu Pro 16.04 LTS | jackson-databind | 2.4.2-3ubuntu0.1~esm2 |