{"id":"CVE-2018-7489","published":"2018-02-26T15:00:00Z","modified":"2026-10-15T17:43:13Z","title":"FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote…","vendor":null,"product":null,"tier":"tail","description":{"text":"FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.19781,"percentile":0.974,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.securityfocus.com/bid/103203","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1448","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1449","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2938","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1450","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2090","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2939","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securitytracker.com/id/1041890","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.securitytracker.com/id/1040693","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1786","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1451","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://www.debian.org/security/2018/dsa-4190","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1447","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2088","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2089","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2858","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3149","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","tags":["x_refsource_CONFIRM"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","tags":["x_refsource_CONFIRM"]},{"url":"https://security.netapp.com/advisory/ntap-20180328-0001/","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/1931","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":19.5,"factors":[{"name":"EPSS percentile","points":19.48}]},"affected":[{"ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","vulnerableRanges":[">=2.8.0, <2.8.11.1",">=2.9.0, <2.9.5",">=2.7.0, <2.7.9.3","<2.6.7.5"],"patched":["2.8.11.1","2.9.5","2.7.9.3","2.6.7.5"],"from":["GHSA-cggj-fvv3-cqwv"],"provenance":"source"}],"euvd":{"id":"EUVD-2018-0576","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-fasterxml-jackson-databind-cve-2017-4995","parents":[{"from":"CVE-2017-7525","to":"CVE-2018-7489","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw.","from":"CVE.org","in":"CVE-2018-7489"},{"kind":"same-code","provenance":"machine","files":["src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java"],"commits":["https://github.com/FasterXML/jackson-databind/commit/fd8dec2c7fab8b4b4bd60502a0f1d63ec23c24da","https://github.com/FasterXML/jackson-databind/commit/fa87c1ddbe803ebb7295f5c2ebfe38e12f6e6162","https://github.com/FasterXML/jackson-databind/commit/e66c0a9d3c926ff1b63bf586c824ead1d02f2a3d","https://github.com/FasterXML/jackson-databind/commit/ca2bfc86af82a1479112004b663ba74c760752e6"],"basis":"shared file"},{"kind":"similar","provenance":"machine","score":0.63,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2017-15095","published":"2018-02-06","fixed":"2.9.4","kev":false,"link":{"from":"CVE-2017-15095","to":"CVE-2018-7489","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:com.fasterxml.jackson.core:jackson-databind","fromFixed":"2.8.11","toFixed":"2.8.11.1","daysApart":20},{"kind":"same-code","provenance":"machine","files":["src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java"],"commits":["https://github.com/FasterXML/jackson-databind/commit/a054585e2175ad0882f07bcafedecfac86230f1b","https://github.com/FasterXML/jackson-databind/commit/a3939d36edcc755c8af55bdc1969e0fa8438f9db","https://github.com/FasterXML/jackson-databind/commit/e66c0a9d3c926ff1b63bf586c824ead1d02f2a3d","https://github.com/FasterXML/jackson-databind/commit/ca2bfc86af82a1479112004b663ba74c760752e6"],"basis":"shared file"},{"kind":"similar","provenance":"machine","score":0.49,"basis":"same package + description similarity"}]}},{"cve":"CVE-2017-17485","published":"2018-01-10","fixed":"2.9.4","kev":false},{"cve":"CVE-2018-5968","published":"2018-01-22","fixed":"2.9.4","kev":false},{"cve":"CVE-2018-7489","published":"2018-02-26","fixed":"2.9.5","kev":false},{"cve":"CVE-2018-11307","published":"2019-07-09","fixed":"2.9.6","kev":false,"link":{"from":"CVE-2018-7489","to":"CVE-2018-11307","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:com.fasterxml.jackson.core:jackson-databind","fromFixed":"2.7.9.3","toFixed":"2.7.9.4","daysApart":498},{"kind":"same-code","provenance":"machine","files":["src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java"],"commits":["https://github.com/FasterXML/jackson-databind/commit/051bd5e447fbc9539e12a4fe90eb989dba0c656e","https://github.com/FasterXML/jackson-databind/commit/27b4defc270454dea6842bd9279f17387eceb737","https://github.com/FasterXML/jackson-databind/commit/e66c0a9d3c926ff1b63bf586c824ead1d02f2a3d","https://github.com/FasterXML/jackson-databind/commit/ca2bfc86af82a1479112004b663ba74c760752e6"],"basis":"shared file"}]}},{"cve":"CVE-2018-12022","published":"2019-03-17","fixed":"2.9.6","kev":false,"link":{"from":"CVE-2018-7489","to":"CVE-2018-12022","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:com.fasterxml.jackson.core:jackson-databind","fromFixed":"2.7.9.3","toFixed":"2.7.9.4","daysApart":384},{"kind":"same-code","provenance":"machine","files":["src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java"],"commits":["https://github.com/FasterXML/jackson-databind/commit/28badf7ef60ac3e7ef151cd8e8ec010b8479226a","https://github.com/FasterXML/jackson-databind/commit/7487cf7eb14be2f65a1eb108e8629c07ef45e0a1","https://github.com/FasterXML/jackson-databind/commit/e66c0a9d3c926ff1b63bf586c824ead1d02f2a3d","https://github.com/FasterXML/jackson-databind/commit/ca2bfc86af82a1479112004b663ba74c760752e6"],"basis":"shared file"}]}},{"cve":"CVE-2018-12023","published":"2019-03-17","fixed":"2.9.6","kev":false,"link":{"from":"CVE-2018-7489","to":"CVE-2018-12023","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:com.fasterxml.jackson.core:jackson-databind","fromFixed":"2.7.9.3","toFixed":"2.7.9.4","daysApart":384},{"kind":"same-code","provenance":"machine","files":["src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java"],"commits":["https://github.com/FasterXML/jackson-databind/commit/28badf7ef60ac3e7ef151cd8e8ec010b8479226a","https://github.com/FasterXML/jackson-databind/commit/7487cf7eb14be2f65a1eb108e8629c07ef45e0a1","https://github.com/FasterXML/jackson-databind/commit/e66c0a9d3c926ff1b63bf586c824ead1d02f2a3d","https://github.com/FasterXML/jackson-databind/commit/ca2bfc86af82a1479112004b663ba74c760752e6"],"basis":"shared file"}]}}],"package":"Maven:com.fasterxml.jackson.core:jackson-databind"}}