{"id":"CVE-2018-7489","published":"2018-02-26T15:00:00Z","modified":"2026-10-15T17:43:13Z","title":"FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote…","vendor":null,"product":null,"tier":"tail","description":{"text":"FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.19781,"percentile":0.97408,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.securityfocus.com/bid/103203","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1448","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1449","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2938","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1450","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2090","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2939","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securitytracker.com/id/1041890","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.securitytracker.com/id/1040693","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1786","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1451","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://www.debian.org/security/2018/dsa-4190","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1447","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2088","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2089","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2858","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3149","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","tags":["x_refsource_CONFIRM"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","tags":["x_refsource_CONFIRM"]},{"url":"https://security.netapp.com/advisory/ntap-20180328-0001/","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/1931","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":19.5,"factors":[{"name":"EPSS percentile","points":19.48}]},"affected":[{"ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","vulnerableRanges":[">=2.8.0, <2.8.11.1",">=2.9.0, <2.9.5",">=2.7.0, <2.7.9.3","<2.6.7.5"],"patched":["2.8.11.1","2.9.5","2.7.9.3","2.6.7.5"],"from":["GHSA-cggj-fvv3-cqwv"],"provenance":"source"}],"euvd":{"id":"EUVD-2018-0576","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-fasterxml-jackson-databind-cve-2017-17485","parents":[{"from":"CVE-2017-7525","to":"CVE-2018-7489","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw.","from":"CVE.org","in":"CVE-2018-7489"},{"kind":"similar","provenance":"machine","score":0.63,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2017-15095","published":"2018-02-06","fixed":"2.9.4","kev":false,"link":{"from":"CVE-2017-15095","to":"CVE-2018-7489","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:com.fasterxml.jackson.core:jackson-databind","fromFixed":"2.8.11","toFixed":"2.8.11.1","daysApart":20},{"kind":"similar","provenance":"machine","score":0.49,"basis":"same package + description similarity"}]}},{"cve":"CVE-2017-17485","published":"2018-01-10","fixed":"2.9.4","kev":false},{"cve":"CVE-2018-5968","published":"2018-01-22","fixed":"2.9.4","kev":false},{"cve":"CVE-2018-7489","published":"2018-02-26","fixed":"2.9.5","kev":false},{"cve":"CVE-2018-11307","published":"2019-07-09","fixed":"2.9.6","kev":false,"link":{"from":"CVE-2018-7489","to":"CVE-2018-11307","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:com.fasterxml.jackson.core:jackson-databind","fromFixed":"2.7.9.3","toFixed":"2.7.9.4","daysApart":498}]}},{"cve":"CVE-2018-12022","published":"2019-03-17","fixed":"2.9.6","kev":false,"link":{"from":"CVE-2018-7489","to":"CVE-2018-12022","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:com.fasterxml.jackson.core:jackson-databind","fromFixed":"2.7.9.3","toFixed":"2.7.9.4","daysApart":384}]}},{"cve":"CVE-2018-12023","published":"2019-03-17","fixed":"2.9.6","kev":false,"link":{"from":"CVE-2018-7489","to":"CVE-2018-12023","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:com.fasterxml.jackson.core:jackson-databind","fromFixed":"2.7.9.3","toFixed":"2.7.9.4","daysApart":384}]}}],"package":"Maven:com.fasterxml.jackson.core:jackson-databind"}}