PT-2018-2763 · Fasterxml+2 · Jackson-Databind+2

Publicado

2018-07-27

·

Atualizado

2021-03-15

·

CVE-2018-14721

CVSS v3.1

10

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.x prior to 2.9.7
Description The issue is related to insufficient checking of incoming requests, which could allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging a failure to block certain classes from polymorphic deserialization. This could potentially enable attackers to exploit the vulnerability and perform SSRF attacks.
Recommendations For versions 2.x prior to 2.9.7, update to version 2.9.7 or later to resolve the issue. As a temporary workaround, consider restricting or disabling the use of polymorphic deserialization to minimize the risk of exploitation.

Exploit

Correção

SSRF

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

ALT-PU-2019-2262
BDU:2019-01755
CVE-2018-14721
DLA-1703-1
DSA-4452-1
GHSA-9MXF-G3X6-WV74
OPENSUSE-SU-2024:10868-1
RHSA-2019:0782
RHSA-2019:1107
RHSA-2019:1108
USN-4813-1

Produtos afetados

Alt Linux
Ubuntu
Jackson-Databind