CVE-2018-12022
- State
- Published
- Severity
- Not scored
- Published
- Mar 17, 2019
- Updated
- Oct 8, 2026
- Reserved
- Jun 7, 2018
Description
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- RHSA-2019:0782vendor-advisory
- RHSA-2019:0877vendor-advisory
- RHBA-2019:0959vendor-advisory
- RHSA-2019:1107vendor-advisory
- RHSA-2019:1108vendor-advisory
- RHSA-2019:1106vendor-advisory
- RHSA-2019:1140vendor-advisory
- DSA-4452vendor-advisory
- 20190527 [SECURITY] [DSA 4452-1] jackson-databind security updatemailing-list
- RHSA-2019:1782vendor-advisory
- RHSA-2019:1797vendor-advisory
- 107585vdb-entry
- RHSA-2019:1822vendor-advisory
- RHSA-2019:1823vendor-advisory
- RHSA-2019:2804vendor-advisory
- RHSA-2019:2858vendor-advisory
- [lucene-issues] 20191004 [GitHub] [lucene-solr] marungo opened a new pull request #925: SOLR-13818: Upgrade jackson to 2.10.0mailing-list
- RHSA-2019:3002vendor-advisory
- RHSA-2019:3140vendor-advisory
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilitiesmailing-list
- RHSA-2019:3149vendor-advisory
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilitiesmailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilitiesmailing-list
- RHSA-2019:3892vendor-advisory
- RHSA-2019:4037vendor-advisory
- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZEDLDUYBSTDY4GWDBUXGJNS2RFYTFVRC/
- https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf
- https://security.netapp.com/advisory/ntap-20190530-0003/
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1671098
- https://github.com/FasterXML/jackson-databind/issues/2052
- https://github.com/FasterXML/jackson-databind/commit/28badf7ef60ac3e7ef151cd8e8ec010b8479226a
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.