{"id":"CVE-2018-11307","published":"2019-07-09T15:37:25Z","modified":"2026-10-08T21:03:28Z","title":"An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.0573,"percentile":0.93046,"provenance":"source"},"cwes":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2019:1822","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1823","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2804","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2858","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d%40%3Cissues.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3002","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3140","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3149","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3892","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:4037","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7525","tags":["x_refsource_MISC"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0782","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/2032","tags":["x_refsource_MISC"]}],"priority":{"score":18.6,"factors":[{"name":"EPSS percentile","points":18.61}]},"affected":[{"ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","vulnerableRanges":[">=2.0.0, <2.7.9.4",">=2.8.0, <2.8.11.2",">=2.9.0, <2.9.6"],"patched":["2.7.9.4","2.8.11.2","2.9.6"],"from":["GHSA-qr7j-h6gg-jmgc"],"provenance":"source"}],"euvd":{"id":"EUVD-2019-0602","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-fasterxml-jackson-databind-cve-2017-17485","parents":[{"from":"CVE-2017-7525","to":"CVE-2018-11307","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-qr7j-h6gg-jmgc","via":"reference","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7525"}]}],"packageHistory":[{"cve":"CVE-2017-17485","published":"2018-01-10","fixed":"2.9.4","kev":false},{"cve":"CVE-2018-5968","published":"2018-01-22","fixed":"2.9.4","kev":false},{"cve":"CVE-2018-7489","published":"2018-02-26","fixed":"2.9.5","kev":false,"link":{"from":"CVE-2018-7489","to":"CVE-2018-11307","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:com.fasterxml.jackson.core:jackson-databind","fromFixed":"2.7.9.3","toFixed":"2.7.9.4","daysApart":498}]}},{"cve":"CVE-2018-11307","published":"2019-07-09","fixed":"2.9.6","kev":false},{"cve":"CVE-2018-12022","published":"2019-03-17","fixed":"2.9.6","kev":false},{"cve":"CVE-2018-12023","published":"2019-03-17","fixed":"2.9.6","kev":false},{"cve":"CVE-2018-14718","published":"2019-01-02","fixed":"2.9.7","kev":false}],"package":"Maven:com.fasterxml.jackson.core:jackson-databind"}}