CVE-2018-1000873

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-12-20 · updated 2026-06-17
Weakness: CWE-20

Description

Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.

Affected products

FasterXML Jackson-Modules-Java8: before 2.9.8 — fixed in 2.9.8
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: from 7.3; from 9.5
Oracle Clusterware: 12.1.0.2.0
Oracle Database: 12.1.0.2, 12.2.0.1, 18c, 19c
Oracle Global Lifecycle Management Opatch: before 11.2.0.3.23; from 12.2.0.1.0 before 12.2.0.1.19; from 13.9.4.0.0 before 13.9.4.2.1 — fixed in 11.2.0.3.23, 12.2.0.1.19, 13.9.4.2.1
Oracle Nosql Database: before 19.3.12 — fixed in 19.3.12

How to fix

Upgrade to a fixed version: FasterXML Jackson-Modules-Java8 2.9.8; Oracle Global Lifecycle Management Opatch 11.2.0.3.23, 12.2.0.1.19, 13.9.4.2.1; Oracle Nosql Database 19.3.12. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-1000873 or the next vulnerability affects your stack