CVE-2018-11307 - 漏洞详情

CVE-2018-11307 (CNNVD-201903-040)

CRITICAL

中文标题:

FasterXML jackson-databind 代码问题漏洞

英文标题:

An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default ty...

CVSS分数: 9.8

发布时间: 2019-07-09 15:37:25

漏洞类型: 代码问题

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

FasterXML jackson-databind是FasterXML公司的一个基于JAVA可以将XML和JSON等数据格式与JAVA对象进行转换的库。Jackson可以轻松的将Java对象转换成json对象和xml文档，同样也可以将json、xml转换成Java对象。 FasterXML jackson-databind 2.7.9.4之前版本、2.8.11.2之前版本和2.9.6之前版本中存在代码问题漏洞。攻击者可利用该漏洞绕过对数据的访问限制，获取敏感信息。

英文描述:

An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.

CWE类型:

CWE-502

受影响产品

厂商	产品	版本	版本范围	平台	CPE
fasterxml	jackson-databind	*	-	-	`cpe:2.3:a:fasterxml:jackson-databind::::::::`
redhat	openshift_container_platform	3.11	-	-	`cpe:2.3:a:redhat:openshift_container_platform:3.11:::::::*`
redhat	openshift_container_platform	4.1	-	-	`cpe:2.3:a:redhat:openshift_container_platform:4.1:::::::*`
oracle	clusterware	12.1.0.2.0	-	-	`cpe:2.3:a:oracle:clusterware:12.1.0.2.0:::::::*`
oracle	communications_instant_messaging_server	10.0.1.2.0	-	-	`cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.2.0:::::::*`
oracle	global_lifecycle_management_opatch	*	-	-	`cpe:2.3:a:oracle:global_lifecycle_management_opatch::::::::`
oracle	retail_customer_management_and_segmentation_foundation	17.0	-	-	`cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:::::::*`
oracle	utilities_advanced_spatial_and_operational_analytics	2.7.0.1	-	-	`cpe:2.3:a:oracle:utilities_advanced_spatial_and_operational_analytics:2.7.0.1:::::::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

RHSA-2019:1822 vendor-advisory
cve.org

访问

RHSA-2019:1823 vendor-advisory
cve.org

访问

RHSA-2019:2804 vendor-advisory
cve.org

访问

RHSA-2019:2858 vendor-advisory
cve.org

访问

[lucene-issues] 20191004 [GitHub] [lucene-solr] marungo opened a new pull request #925: SOLR-13818: Upgrade jackson to 2.10.0 mailing-list
cve.org

访问

RHSA-2019:3002 vendor-advisory
cve.org

访问

RHSA-2019:3140 vendor-advisory
cve.org

访问

[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
cve.org

访问

RHSA-2019:3149 vendor-advisory
cve.org

访问

[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
cve.org

访问

[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
cve.org

访问

RHSA-2019:3892 vendor-advisory
cve.org

访问

RHSA-2019:4037 vendor-advisory
cve.org

访问