{"id":"CVE-2018-5968","published":"2018-01-22T04:00:00Z","modified":"2026-10-08T21:13:46Z","title":"FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because…","vendor":null,"product":null,"tier":"tail","description":{"text":"FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.07245,"percentile":0.94313,"provenance":"source"},"cwes":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2018:0479","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0481","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1525","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0480","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://www.debian.org/security/2018/dsa-4114","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0478","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2858","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3149","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","tags":["x_refsource_CONFIRM"]},{"url":"https://security.netapp.com/advisory/ntap-20180423-0002/","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/1899","tags":["x_refsource_MISC"]}],"priority":{"score":18.9,"factors":[{"name":"EPSS percentile","points":18.86}]},"affected":[{"ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","vulnerableRanges":[">=2.8.0, <2.8.11.1",">=2.9.0, <2.9.4","<2.7.9.5"],"patched":["2.8.11.1","2.9.4","2.7.9.5"],"from":["GHSA-w3f4-3q6j-rh82"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0519","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-fasterxml-jackson-databind-cve-2017-4995","parents":[{"from":"CVE-2017-17485","to":"CVE-2018-5968","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws.","from":"CVE.org","in":"CVE-2018-5968"},{"kind":"version-step","provenance":"source","package":"Maven:com.fasterxml.jackson.core:jackson-databind","fromFixed":"2.8.11","toFixed":"2.8.11.1","daysApart":12},{"kind":"same-code","provenance":"machine","files":["src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java"],"commits":["https://github.com/FasterXML/jackson-databind/commit/10fe7f17ea7c8da2a71e7a0c774b420a1d5c1b50","https://github.com/FasterXML/jackson-databind/commit/2235894210c75f624a3d0cd60bfb0434a20a18bf","https://github.com/FasterXML/jackson-databind/commit/454be8bb8c913be18298327a84ca45a280b61605"],"basis":"shared file"}]},{"from":"CVE-2017-7525","to":"CVE-2018-5968","relation":"incomplete-fix","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws.","from":"CVE.org","in":"CVE-2018-5968"}]}],"packageHistory":[{"cve":"CVE-2017-7525","published":"2018-02-06","fixed":"2.8.9","kev":false},{"cve":"CVE-2017-15095","published":"2018-02-06","fixed":"2.9.4","kev":false},{"cve":"CVE-2017-17485","published":"2018-01-10","fixed":"2.9.4","kev":false},{"cve":"CVE-2018-5968","published":"2018-01-22","fixed":"2.9.4","kev":false},{"cve":"CVE-2018-7489","published":"2018-02-26","fixed":"2.9.5","kev":false},{"cve":"CVE-2018-11307","published":"2019-07-09","fixed":"2.9.6","kev":false},{"cve":"CVE-2018-12022","published":"2019-03-17","fixed":"2.9.6","kev":false}],"package":"Maven:com.fasterxml.jackson.core:jackson-databind"}}