CVE-2018-1000873 - 漏洞详情

CVE-2018-1000873 (CNNVD-201812-938)

MEDIUM

中文标题:

FasterXML Jackson 输入验证错误漏洞

英文标题:

Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in...

CVSS分数: 6.5

发布时间: 2018-12-20 17:00:00

漏洞类型: 输入验证错误

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

FasterXML Jackson是美国FasterXML公司的一款适用于Java的数据处理工具。 FasterXML Jackson 2.9.8之前版本中的Jackson-Modules-Java8存在输入验证错误漏洞。该漏洞源于网络系统或产品未对输入的数据进行正确的验证。

英文描述:

Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.

CWE类型:

CWE-20

受影响产品

厂商	产品	版本	版本范围	平台	CPE
fasterxml	jackson-modules-java8	*	-	-	`cpe:2.3:a:fasterxml:jackson-modules-java8::::::::`
oracle	clusterware	12.1.0.2.0	-	-	`cpe:2.3:a:oracle:clusterware:12.1.0.2.0:::::::*`
oracle	database_server	12.1.0.2	-	-	`cpe:2.3:a:oracle:database_server:12.1.0.2:::::::*`
oracle	database_server	12.2.0.1	-	-	`cpe:2.3:a:oracle:database_server:12.2.0.1:::::::*`
oracle	database_server	18c	-	-	`cpe:2.3:a:oracle:database_server:18c:::::::*`
oracle	database_server	19c	-	-	`cpe:2.3:a:oracle:database_server:19c:::::::*`
oracle	global_lifecycle_management_opatch	*	-	-	`cpe:2.3:a:oracle:global_lifecycle_management_opatch::::::::`
oracle	nosql_database	*	-	-	`cpe:2.3:a:oracle:nosql_database::::::::`
netapp	active_iq_unified_manager	*	-	-	`cpe:2.3:a:netapp:active_iq_unified_manager::::::linux::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

[pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1 mailing-list
cve.org

访问

[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
cve.org

访问

[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
cve.org

访问

[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
cve.org

访问

[nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html mailing-list
cve.org

访问

[nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html mailing-list
cve.org

访问