PT-2018-2763 · Fasterxml+2 · Jackson-Databind+2

Published

2018-07-27

·

Updated

2021-03-15

·

CVE-2018-14721

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.x prior to 2.9.7
Description The issue is related to insufficient checking of incoming requests, which could allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging a failure to block certain classes from polymorphic deserialization. This could potentially enable attackers to exploit the vulnerability and perform SSRF attacks.
Recommendations For versions 2.x prior to 2.9.7, update to version 2.9.7 or later to resolve the issue. As a temporary workaround, consider restricting or disabling the use of polymorphic deserialization to minimize the risk of exploitation.

Exploit

Fix

SSRF

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-918

Related Identifiers

ALT-PU-2019-2262
BDU:2019-01755
CVE-2018-14721
DLA-1703-1
DSA-4452-1
GHSA-9MXF-G3X6-WV74
OPENSUSE-SU-2024:10868-1
RHSA-2019:0782
RHSA-2019:1107
RHSA-2019:1108
USN-4813-1

Affected Products

Alt Linux
Ubuntu
Jackson-Databind