CVE-2018-12023: FasterXML jackson-databind Deserialization of Untrusted Data
Summary
CVE-2018-12023: Deserialization of Untrusted Data. Affects com.fasterxml.jackson.core:jackson-databind across 3 version ranges.
>= 2.7.0, < 2.7.9.4
>= 2.8.0, < 2.8.11.2
>= 2.9.0, < 2.9.6
Fixed in 2.7.9.4, 2.8.11.2 or 2.9.6, depending on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2018-12023 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FasterXML jackson-databind is a popular Java library used for serializing and deserializing JSON data. It provides a powerful and flexible API for working with JSON objects. However, prior to versions 2.7.9.4, 2.8.11.2, and 2.9.6, there is a vulnerability in the library that allows for the deserialization of untrusted data. This vulnerability can be exploited when Default Typing is enabled and the Oracle JDBC jar is present in the classpath. An attacker can provide an LDAP service to access, which can then execute a malicious payload.
Vulnerability Detail
The vulnerability in FasterXML jackson-databind allows an attacker to execute arbitrary code by providing malicious input during the deserialization process. This can lead to remote code execution, enabling the attacker to take control of the affected system. The issue arises when Default Typing is enabled and the Oracle JDBC jar is present, as it allows the deserialization of untrusted data. The impact of this vulnerability is high, as it can lead to unauthorized access, data breaches, and potential system compromise.
How To Fix
Latest published version: 2.22.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.7.0, < 2.7.9.42.7.9.4 -
>= 2.8.0, < 2.8.11.22.8.11.2 -
>= 2.9.0, < 2.9.62.9.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a non-vulnerable version is not immediately feasible, a possible workaround is to disable Default Typing or remove the Oracle JDBC jar from the classpath. Disabling Default Typing can be done by configuring the ObjectMapper with the disableDefaultTyping() method. Removing the Oracle JDBC jar from the classpath involves identifying and removing the jar file from the application's dependencies.
Conclusion
The vulnerability in FasterXML jackson-databind allows for the deserialization of untrusted data, potentially leading to remote code execution. It is crucial to upgrade to the latest non-vulnerable version of the library to mitigate the risk. If immediate upgrade is not possible, disabling Default Typing or removing the Oracle JDBC jar from the classpath can serve as temporary workarounds. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
FasterXML jackson-databind is a Java library used for serializing and deserializing JSON data. It provides a flexible and efficient API for working with JSON objects.
Default Typing is a feature in FasterXML jackson-databind that allows automatic inclusion of type information during serialization and deserialization. It enables the library to handle polymorphic types.
The vulnerability allows for the execution of arbitrary code, potentially leading to remote code execution. This can result in unauthorized access, data breaches, and system compromise.
To mitigate the risk, it is recommended to upgrade to the latest non-vulnerable version of FasterXML jackson-databind. If immediate upgrade is not possible, disabling Default Typing or removing the Oracle JDBC jar from the classpath can serve as temporary workarounds.
For more information about this vulnerability, you can refer to the GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/06/GHSA-6wqp-v4v6-c87c/GHSA-6wqp-v4v6-c87c.json
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
