9.8
CRITICAL
CVE-2018-7489
FasterXML Jackson Databind Remote Code Execution Vulnerability
Description

FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.

INFO

Published Date :

Feb. 26, 2018, 3:29 p.m.

Last Modified :

Nov. 7, 2023, 3:01 a.m.

Source :

[email protected]

Remotely Exploitable :

Yes !

Impact Score :

5.9

Exploitability Score :

3.9
Public PoC/Exploit Available at Github

CVE-2018-7489 has a 19 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2018-7489 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Oracle communications_billing_and_revenue_management
2 Oracle communications_instant_messaging_server
1 Debian debian_linux
1 Redhat jboss_enterprise_application_platform
1 Fasterxml jackson-databind
: Total Affected Vendor : 4 | Products : 5
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2018-7489.

URL Resource
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html Patch
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html Patch
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch
http://www.securityfocus.com/bid/103203 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1040693 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1041890 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2018:1447 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1448 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1449 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1450 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1451 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1786 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2088 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2089 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2090 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2938 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2939 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2858
https://access.redhat.com/errata/RHSA-2019:3149
https://github.com/FasterXML/jackson-databind/issues/1931 Third Party Advisory
https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3E
https://security.netapp.com/advisory/ntap-20180328-0001/ Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us Third Party Advisory
https://www.debian.org/security/2018/dsa-4190 Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
seal-community/patches

A centralized repository of standalone security patches for open source libraries.

appsec backport cve devsecops fix hotfix open-source patch protection remediation seal security update upgrade vulnerability

Updated: 4 months, 3 weeks ago
182 stars 0 fork 0 watcher
Born at : July 30, 2023, 4:46 p.m. This repo has been linked 265 different CVEs too.
Profile Photo
hectorgie/PoC-in-GitHub

None

Updated: 1 year, 3 months ago
17 stars 10 fork 10 watcher
Born at : Jan. 2, 2021, 10:19 p.m. This repo has been linked 1050 different CVEs too.
Profile Photo
yahoo/cubed

Data Mart As A Service

bigdata datamart etl funnel-analysis dataanalysis businessintelligence saas

Makefile Java Python Shell CSS HTML HiveQL StringTemplate

Updated: 1 year, 2 months ago
27 stars 5 fork 5 watcher
Born at : Nov. 24, 2020, 5:03 a.m. This repo has been linked 54 different CVEs too.
Profile Photo
cf-testorg/aws-sdk-java-test

None

Java Gherkin FreeMarker Shell Batchfile Scilab

Updated: 4 years, 1 month ago
0 stars 2 fork 2 watcher
Born at : Oct. 9, 2020, 5:05 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
0xT11/CVE-POC

None

Updated: 3 months ago
82 stars 32 fork 32 watcher
Born at : Oct. 2, 2020, 2:49 p.m. This repo has been linked 1111 different CVEs too.
Profile Photo
PalindromeLabs/Java-Deserialization-CVEs

Compiled dataset of Java deserialization CVEs

java-deserialization deserialization cve security

Updated: 6 months, 1 week ago
60 stars 4 fork 4 watcher
Born at : July 22, 2020, 1:10 p.m. This repo has been linked 308 different CVEs too.
Profile Photo
dotanuki-labs/android-oss-cves-research

An analysis on open-source Android apps intended to learn if they are harmed by vulnerable dependencies 🔒

gradle cli security supply-chain-analytics python

Python Shell

Updated: 2 years, 9 months ago
8 stars 2 fork 2 watcher
Born at : June 4, 2020, 9:48 p.m. This repo has been linked 15 different CVEs too.
Profile Photo
zema1/oracle-vuln-crawler

抓取 Weblogic 等 Oracle 组件的历史漏洞信息

Go

Updated: 10 months, 1 week ago
6 stars 1 fork 1 watcher
Born at : March 13, 2020, 1:17 p.m. This repo has been linked 33 different CVEs too.
Profile Photo
ilmari666/cybsec

Cyber Securiy MOOC Unsecure project

Java HTML

Updated: 2 years, 5 months ago
1 stars 1 fork 1 watcher
Born at : Dec. 29, 2019, 12:57 p.m. This repo has been linked 70 different CVEs too.
Profile Photo
maddoudou22/test-aws-sdk-java-B

None

Batchfile Java Gherkin FreeMarker Shell Scilab

Updated: 5 years, 4 months ago
0 stars 1 fork 1 watcher
Born at : June 26, 2019, 12:39 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
maddoudou22/test-aws-sdk-java

None

Batchfile Java Gherkin FreeMarker Shell Scilab

Updated: 5 years, 4 months ago
0 stars 0 fork 0 watcher
Born at : May 25, 2019, 11:23 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
maddoudou22/repo-aws-sdk-java

None

Java Gherkin FreeMarker Shell Batchfile Scilab

Updated: 5 years, 9 months ago
0 stars 0 fork 0 watcher
Born at : Feb. 15, 2019, 1:54 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
tafamace/CVE-2018-7489

None

Java

Updated: 6 years ago
0 stars 0 fork 0 watcher
Born at : Nov. 19, 2018, 1:13 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
dashpradeep99/https-github.com-aws-aws-sdk-java

None

Java Gherkin FreeMarker Scilab

Updated: 6 years ago
0 stars 0 fork 0 watcher
Born at : Oct. 25, 2018, 8:39 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
dashpradeep99/aws-sdk-java-code

None

Java Gherkin FreeMarker Scilab

Updated: 5 years, 9 months ago
1 stars 1 fork 1 watcher
Born at : Oct. 25, 2018, 8:17 a.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2018-7489 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2018-7489 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Nov. 07, 2023

    Action Type Old Value New Value
    Added Reference MITRE https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3E [No types assigned]
    Removed Reference MITRE https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1@%3Ccommits.druid.apache.org%3E
  • CVE Modified by [email protected]

    Mar. 25, 2021

    Action Type Old Value New Value
    Added Reference https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1@%3Ccommits.druid.apache.org%3E [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 20, 2020

    Action Type Old Value New Value
    Added Reference https://www.oracle.com/security-alerts/cpuoct2020.html [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 18, 2019

    Action Type Old Value New Value
    Added Reference https://access.redhat.com/errata/RHSA-2019:3149 [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 27, 2019

    Action Type Old Value New Value
    Added Reference https://access.redhat.com/errata/RHSA-2019:2858 [No Types Assigned]
  • Modified Analysis by [email protected]

    Aug. 22, 2019

    Action Type Old Value New Value
    Changed Reference Type https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html No Types Assigned https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch
    Added CPE Configuration OR *cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.19:*:*:*:*:*:*:* *cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.2:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Jul. 23, 2019

    Action Type Old Value New Value
    Added Reference https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html [No Types Assigned]
  • Modified Analysis by [email protected]

    May. 10, 2019

    Action Type Old Value New Value
    Changed Reference Type https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch, Third Party Advisory
    Changed Reference Type https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html No Types Assigned https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch, Third Party Advisory
    Added CPE Configuration OR *cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Apr. 23, 2019

    Action Type Old Value New Value
    Added Reference https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html [No Types Assigned]
  • Modified Analysis by [email protected]

    Mar. 26, 2019

    Action Type Old Value New Value
    Changed Reference Type https://access.redhat.com/errata/RHSA-2018:2938 No Types Assigned https://access.redhat.com/errata/RHSA-2018:2938 Third Party Advisory
    Changed Reference Type https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us No Types Assigned https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us Third Party Advisory
    Changed Reference Type http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html No Types Assigned http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch
    Changed Reference Type http://www.securitytracker.com/id/1041890 No Types Assigned http://www.securitytracker.com/id/1041890 Third Party Advisory, VDB Entry
    Changed Reference Type https://access.redhat.com/errata/RHSA-2018:1448 No Types Assigned https://access.redhat.com/errata/RHSA-2018:1448 Third Party Advisory
    Changed Reference Type https://access.redhat.com/errata/RHSA-2018:1449 No Types Assigned https://access.redhat.com/errata/RHSA-2018:1449 Third Party Advisory
    Changed Reference Type https://access.redhat.com/errata/RHSA-2018:1447 No Types Assigned https://access.redhat.com/errata/RHSA-2018:1447 Third Party Advisory
    Changed Reference Type http://www.securitytracker.com/id/1040693 No Types Assigned http://www.securitytracker.com/id/1040693 Third Party Advisory, VDB Entry
    Changed Reference Type https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html No Types Assigned https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch
    Changed Reference Type http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html No Types Assigned http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html Patch
    Changed Reference Type https://security.netapp.com/advisory/ntap-20180328-0001/ No Types Assigned https://security.netapp.com/advisory/ntap-20180328-0001/ Third Party Advisory
    Changed Reference Type https://access.redhat.com/errata/RHSA-2018:2939 No Types Assigned https://access.redhat.com/errata/RHSA-2018:2939 Third Party Advisory
    Changed Reference Type https://www.debian.org/security/2018/dsa-4190 No Types Assigned https://www.debian.org/security/2018/dsa-4190 Third Party Advisory
    Changed Reference Type https://access.redhat.com/errata/RHSA-2018:2090 No Types Assigned https://access.redhat.com/errata/RHSA-2018:2090 Third Party Advisory
    Changed Reference Type https://access.redhat.com/errata/RHSA-2018:1786 No Types Assigned https://access.redhat.com/errata/RHSA-2018:1786 Third Party Advisory
    Changed Reference Type https://access.redhat.com/errata/RHSA-2018:1451 No Types Assigned https://access.redhat.com/errata/RHSA-2018:1451 Third Party Advisory
    Changed Reference Type https://access.redhat.com/errata/RHSA-2018:2089 No Types Assigned https://access.redhat.com/errata/RHSA-2018:2089 Third Party Advisory
    Changed Reference Type http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html No Types Assigned http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html Patch
    Changed Reference Type https://access.redhat.com/errata/RHSA-2018:1450 No Types Assigned https://access.redhat.com/errata/RHSA-2018:1450 Third Party Advisory
    Changed Reference Type https://access.redhat.com/errata/RHSA-2018:2088 No Types Assigned https://access.redhat.com/errata/RHSA-2018:2088 Third Party Advisory
    Changed CPE Configuration OR *cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* versions up to (excluding) 2.8.11.1 *cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* versions from (including) 2.9.0 up to (including) 2.9.4 OR *cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* versions up to (excluding) 2.7.9.3 *cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* versions from (including) 2.8.0 up to (excluding) 2.8.11.1 *cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* versions from (including) 2.9.0 up to (excluding) 2.9.5
    Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* *cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Jan. 16, 2019

    Action Type Old Value New Value
    Added Reference https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html [No Types Assigned]
  • CVE Modified by [email protected]

    Nov. 28, 2018

    Action Type Old Value New Value
    Changed Description FasterXML jackson-databind before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath. FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.
  • CVE Modified by [email protected]

    Oct. 18, 2018

    Action Type Old Value New Value
    Added Reference https://access.redhat.com/errata/RHSA-2018:2939 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2018:2938 [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 17, 2018

    Action Type Old Value New Value
    Added Reference http://www.securitytracker.com/id/1041890 [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 17, 2018

    Action Type Old Value New Value
    Added Reference http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 27, 2018

    Action Type Old Value New Value
    Removed Reference https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03902en_us [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 27, 2018

    Action Type Old Value New Value
    Added Reference https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us [No Types Assigned]
    Added Reference https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03902en_us [No Types Assigned]
  • CVE Modified by [email protected]

    Jul. 19, 2018

    Action Type Old Value New Value
    Added Reference http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html [No Types Assigned]
  • CVE Modified by [email protected]

    Jun. 29, 2018

    Action Type Old Value New Value
    Added Reference https://access.redhat.com/errata/RHSA-2018:2090 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2018:2089 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2018:2088 [No Types Assigned]
  • CVE Modified by [email protected]

    Jun. 06, 2018

    Action Type Old Value New Value
    Added Reference https://access.redhat.com/errata/RHSA-2018:1786 [No Types Assigned]
  • CVE Modified by [email protected]

    May. 17, 2018

    Action Type Old Value New Value
    Added Reference https://access.redhat.com/errata/RHSA-2018:1451 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2018:1450 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2018:1449 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2018:1448 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2018:1447 [No Types Assigned]
  • CVE Modified by [email protected]

    May. 05, 2018

    Action Type Old Value New Value
    Added Reference https://www.debian.org/security/2018/dsa-4190 [No Types Assigned]
  • CVE Modified by [email protected]

    Apr. 20, 2018

    Action Type Old Value New Value
    Added Reference http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html [No Types Assigned]
  • CVE Modified by [email protected]

    Apr. 19, 2018

    Action Type Old Value New Value
    Added Reference http://www.securitytracker.com/id/1040693 [No Types Assigned]
  • CVE Modified by [email protected]

    Mar. 30, 2018

    Action Type Old Value New Value
    Added Reference https://security.netapp.com/advisory/ntap-20180328-0001/ [No Types Assigned]
  • Initial Analysis by [email protected]

    Mar. 22, 2018

    Action Type Old Value New Value
    Added CVSS V2 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
    Added CVSS V3 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Changed Reference Type https://github.com/FasterXML/jackson-databind/issues/1931 No Types Assigned https://github.com/FasterXML/jackson-databind/issues/1931 Third Party Advisory
    Changed Reference Type http://www.securityfocus.com/bid/103203 No Types Assigned http://www.securityfocus.com/bid/103203 Third Party Advisory, VDB Entry
    Added CWE CWE-502
    Added CWE CWE-184
    Added CPE Configuration OR *cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* versions up to (excluding) 2.8.11.1 *cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* versions from (including) 2.9.0 up to (including) 2.9.4
  • CVE Modified by [email protected]

    Mar. 06, 2018

    Action Type Old Value New Value
    Added Reference http://www.securityfocus.com/bid/103203 [No Types Assigned]
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

93.67 }} -0.47%

score

0.99177

percentile

CVSS30 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
: