CVE-2018-14719

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 9.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-01-02 · updated 2026-10-08
Weakness: CWE-502

Description

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.

Affected products

Debian Linux: 8.0, 9.0
FasterXML jackson-databind: from 2.0.0 before 2.6.7.3; from 2.7.0 before 2.7.9.5; from 2.8.0 before 2.8.11.3; from 2.9.0 before 2.9.7 — fixed in 2.6.7.3, 2.7.9.5, 2.8.11.3, 2.9.7
NetApp OnCommand Workflow Automation: all versions
NetApp SnapCenter: all versions
NetApp Steelstore Cloud Integrated Storage: all versions
Oracle Banking Platform: 2.5.0, 2.6.0, 2.6.1, 2.6.2
Oracle Corporation Oracle Business Process Management Suite: 12.1.3.0.0, 12.2.1.3.0
Oracle Clusterware: 12.1.0.2.0
Oracle Corporation Communications Billing and Revenue Management: 7.5, 12.0
Oracle Database: 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c
Oracle Enterprise Manager For Virtualization: 13.2.2, 13.2.3, 13.3.1
Oracle Corporation Financial Services Analytical Applications Infrastructure: 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7
Oracle Global Lifecycle Management Opatch: before 11.2.0.3.23; from 12.2.0.1.0 before 12.2.0.1.19; from 13.9.4.0.0 before 13.9.4.2.1 — fixed in 11.2.0.3.23, 12.2.0.1.19, 13.9.4.2.1
Oracle Corporation Oracle JDeveloper: 12.1.3.0.0, 12.2.1.3.0
Oracle Corporation Primavera P6 Enterprise Project Portfolio Management: from 17.7 through 17.12; 15.1, 15.2, 16.1, 16.2, 18.8
Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 16.1, 16.2, 18.8
Oracle Corporation Retail Merchandising System: 15.0, 16.0
Oracle Retail Workforce Management Software: 1.60.9.0.0
Oracle Corporation Oracle WebCenter Portal: 12.2.1.3.0
Red Hat OpenShift Container Platform 4.18: from 3.11 before 3.11.153; from 4.6 before 4.6.26; from 4.1 before 4.1.18 — fixed in 3.11.153, 4.1.18, 4.6.26

How to fix

Upgrade to a fixed version: FasterXML jackson-databind 2.6.7.3, 2.7.9.5, 2.8.11.3, 2.9.7; Oracle Global Lifecycle Management Opatch 11.2.0.3.23, 12.2.0.1.19, 13.9.4.2.1; Red Hat OpenShift Container Platform 4.18 3.11.153, 4.1.18, 4.6.26. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-14719 or the next vulnerability affects your stack