CVE-2018-19362
Fixed in a distro release EPSS 11%
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
Products: FasterXML jackson-databind, debian_linux, oracle business_process_management_suite, oracle primavera_p6_enterprise_project_portfolio_management, oracle primavera_unifier, oracle retail_workforce_management_software, oracle webcenter_portal, redhat automation_manager, redhat decision_manager, redhat jboss_bpm_suite, redhat jboss_brms, redhat openshift_container_platform
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | com.fasterxml.jackson.core:jackson-databind | 2.9.8 |
| Maven | com.fasterxml.jackson.core:jackson-databind | 2.8.11.3 |
| Maven | com.fasterxml.jackson.core:jackson-databind | 2.7.9.5 |
| Maven | com.fasterxml.jackson.core:jackson-databind | 2.6.7.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | eco-java-gradle-2.10 | no fix |
| Chainguard | eco-java-gradle-2.11 | no fix |
| Chainguard | eco-java-gradle-2.12 | no fix |
| Chainguard | eco-java-gradle-2.13 | no fix |
| Chainguard | eco-java-gradle-2.14 | no fix |
| Chainguard | eco-java-gradle-2.14.1 | no fix |
| Chainguard | eco-java-gradle-2.4 | no fix |
| Chainguard | eco-java-gradle-2.5 | no fix |
| Chainguard | eco-java-gradle-2.6 | no fix |
| Chainguard | eco-java-gradle-2.7 | no fix |
| Chainguard | eco-java-gradle-2.8 | no fix |
| Chainguard | eco-java-gradle-2.9 | no fix |
| Chainguard | eco-java-gradle-3.0 | no fix |
| Chainguard | eco-java-gradle-3.1 | no fix |
| Chainguard | eco-java-gradle-3.2 | no fix |
| Chainguard | eco-java-gradle-3.2.1 | no fix |
| Chainguard | eco-java-gradle-3.3 | no fix |
| Chainguard | eco-java-gradle-3.4 | no fix |
| Chainguard | eco-java-gradle-3.4.1 | no fix |
| Chainguard | eco-java-gradle-3.5 | no fix |
| Chainguard | eco-java-gradle-3.5.1 | no fix |
| Chainguard | eco-java-gradle-4.0 | no fix |
| Chainguard | eco-java-gradle-4.0.1 | no fix |
| Chainguard | eco-java-gradle-4.0.2 | no fix |
| Chainguard | eco-java-gradle-4.1 | no fix |
| Chainguard | eco-java-gradle-4.10 | no fix |
| Chainguard | eco-java-gradle-4.10.1 | no fix |
| Chainguard | eco-java-gradle-4.10.2 | no fix |
| Chainguard | eco-java-gradle-4.10.3 | no fix |
| Chainguard | eco-java-gradle-4.2 | no fix |
| Chainguard | eco-java-gradle-4.2.1 | no fix |
| Chainguard | eco-java-gradle-4.3 | no fix |
| Chainguard | eco-java-gradle-4.3.1 | no fix |
| Chainguard | eco-java-gradle-4.4 | no fix |
| Chainguard | eco-java-gradle-4.4.1 | no fix |
| Chainguard | eco-java-gradle-4.5 | no fix |
| Chainguard | eco-java-gradle-4.5.1 | no fix |
| Chainguard | eco-java-gradle-4.6 | no fix |
| Chainguard | eco-java-gradle-4.7 | no fix |
| Chainguard | eco-java-gradle-4.8 | no fix |
| Chainguard | eco-java-gradle-4.8.1 | no fix |
| Chainguard | eco-java-gradle-4.9 | no fix |
| Chainguard | eco-java-gradle-5.0 | no fix |
| Chainguard | eco-java-gradle-5.1 | no fix |
| Chainguard | eco-java-gradle-5.1.1 | no fix |
| Chainguard | eco-java-gradle-5.2 | no fix |
| Chainguard | eco-java-gradle-5.2.1 | no fix |
| Chainguard | hadoop-fips-3.3.6 | no fix |
| Chainguard | hadoop-fips-3.4.2 | no fix |
| Chainguard | hadoop-fips-3.5 | no fix |
| Debian 12 | jackson-databind | 2.9.8-1 |
| Debian 13 | jackson-databind | 2.9.8-1 |
| Debian 14 | jackson-databind | 2.9.8-1 |
| Debian 8 | jackson-databind | 2.4.2-2+deb8u5 |
| Debian 9 | jackson-databind | 2.8.6-1+deb9u5 |
| Red Hat rhel software collections 3 | rh-maven35-jackson-databind | 0:2.7.6-2.5.el7 |
| Red Hat rhel software collections 3 | rh-maven35-jackson-databind-javadoc | 0:2.7.6-2.5.el7 |
| Ubuntu 18.04 LTS | jackson-databind | no fix |
| Ubuntu Pro 14.04 LTS | jackson-databind | no fix |
| Ubuntu Pro 16.04 LTS | jackson-databind | 2.4.2-3ubuntu0.1~esm2 |