What’s Vulnerable › Vulnerabilities
CVE-2018-5968
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 7.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-01-22 · updated 2026-10-08
- Weakness: CWE-184
Description
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.
Affected products
- Debian Linux: 8.0, 9.0
- FasterXML jackson-databind: from 2.0.0 before 2.6.7.3; from 2.7.0 before 2.7.9.2; from 2.8.0 before 2.8.11.1; from 2.9.0 before 2.9.4 — fixed in 2.6.7.3, 2.7.9.2, 2.8.11.1, 2.9.4
- E-Series SANtricity OS Controller Software 11.x: from 11.0.0 through 11.60.3
- NetApp E-Series Santricity Web Services Proxy: all versions
- NetApp Oncommand Shift: all versions
- Red Hat JBoss EAP: 7.1
- Red Hat OpenShift Container Platform 4.18: 4.1, 3.11
- RedHat Virtualization: 4.0
- RedHat Virtualization Host: 4.0
How to fix
Upgrade to a fixed version: FasterXML jackson-databind 2.6.7.3, 2.7.9.2, 2.8.11.1, 2.9.4. Check the vendor advisory for mitigations.
References
- https://access.redhat.com/errata/RHSA-2018:0478
- https://access.redhat.com/errata/RHSA-2018:0479
- https://access.redhat.com/errata/RHSA-2018:0480
- https://access.redhat.com/errata/RHSA-2018:0481
- https://access.redhat.com/errata/RHSA-2018:1525
- https://access.redhat.com/errata/RHSA-2019:2858
- https://access.redhat.com/errata/RHSA-2019:3149
- https://github.com/FasterXML/jackson-databind/issues/1899
- https://security.netapp.com/advisory/ntap-20180423-0002/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us
- https://www.debian.org/security/2018/dsa-4114
- https://www.oracle.com/security-alerts/cpuoct2020.html
Get alerted when CVE-2018-5968 or the next vulnerability affects your stack