Critical Remote Code Execution Vulnerability in jackson-databind
Summary
CVE-2018-14718: FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization. Affects jackson-databind across 2 version ranges.
< 2.9.8-1
< 87d29af25e82a249ea15858e2d4ecbf64091db44
Fixed in 2.9.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jackson-databind is a widely used library in Java for converting Java objects to JSON and vice versa. It is part of the Jackson suite of data-processing tools and is known for its performance and flexibility. However, versions prior to 2.9.7 are vulnerable to a serious issue that allows remote attackers to execute arbitrary code due to improper handling of polymorphic deserialization.
Vulnerability Detail
The vulnerability, identified as CVE-2018-14718, arises from the failure to block the slf4j-ext class during polymorphic deserialization. This oversight can be exploited by remote attackers to execute arbitrary code on the affected system. The potential ramifications include unauthorized access, data manipulation, and complete system compromise. The vulnerability affects multiple versions of jackson-databind across various Debian ecosystems.
How To Fix
Minimum fixed version
2.9.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not possible, consider implementing input validation to restrict the types of objects that can be deserialized. This can help mitigate the risk of exploitation until the library is updated.
Conclusion
CVE-2018-14718 is a critical vulnerability in the jackson-databind library that poses significant risks to applications using affected versions. It is crucial to upgrade to version 2.9.8-1 or later to mitigate the risk of remote code execution. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your software.
See every vulnerability recorded for jackson-databind →
FAQ
CVE-2018-14718 is a critical vulnerability in the jackson-databind library that allows remote code execution due to improper handling of polymorphic deserialization.
Versions of jackson-databind prior to 2.9.7 are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score for CVE-2018-14718 is 9.8, indicating a critical level of severity.
If an immediate upgrade is not feasible, implement input validation to restrict deserialization types as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
