FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
5128ECDA-6F9A-42AC-9063-CDFC4C256537
2.6.7.2
2.6.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
B99066EB-FF79-4D9D-9466-B04AD4D3A814
2.7.9.5
2.7.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
F4D3858C-DAF3-4522-90EC-EFCD13BD121E
2.8.11.3
2.8.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
E92778FA-5912-46E8-A33B-4BD14935647B
2.9.8
2.9.0
OR
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43
OR
cpe:2.3:a:oracle:business_process_management_suite:12.1.3.0.0:*:*:*:*:*:*:*
B887E174-57AB-449D-AEE4-82DD1A3E5C84
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*
E869C417-C0E6-4FC3-B406-45598A1D1906
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*
7A1E1023-2EB9-4334-9B74-CA71480F71C2
17.12
17.7
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:15.1:*:*:*:*:*:*:*
93A4E178-0082-45C5-BBC0-0A4E51C8B1DE
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:15.2:*:*:*:*:*:*:*
3F021C23-AB9B-4877-833F-D01359A98762
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:16.1:*:*:*:*:*:*:*
2F8ED016-32A1-42EE-844E-3E6B2C116B74
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:16.2:*:*:*:*:*:*:*
A046CC2C-445F-4336-8810-930570B4FEC6
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:18.8:*:*:*:*:*:*:*
0745445C-EC43-4091-BA7C-5105AFCC6F1F
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*
08FA59A8-6A62-4B33-8952-D6E658F8DAC9
17.12
17.7
cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*
D55A54FD-7DD1-49CD-BE81-0BE73990943C
cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*
82EB08C0-2D46-4635-88DF-E54F6452D3A3
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*
202AD518-2E9B-4062-B063-9858AE1F9CE2
cpe:2.3:a:oracle:retail_workforce_management_software:1.60.9.0.0:*:*:*:*:*:*:*
9967AAFD-2199-4668-9105-207D4866B707
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
D6A4F71A-4269-40FC-8F61-1D1301F2B728
OR
cpe:2.3:a:redhat:automation_manager:7.3.1:*:*:*:*:*:*:*
D44D4F38-4028-4EAA-895C-1E2816FB36EA
cpe:2.3:a:redhat:decision_manager:7.3.1:*:*:*:*:*:*:*
D5CD928F-C9BA-443F-A46D-4FE7756D936B
cpe:2.3:a:redhat:jboss_bpm_suite:6.4.11:*:*:*:*:*:*:*
07E373FB-14EA-4EA2-8E4A-0B86A7184B85
cpe:2.3:a:redhat:jboss_brms:6.4.10:*:*:*:*:*:*:*
88C5E02F-C70E-41F4-B146-40C88439017A
cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*
2F87326E-0B56-4356-A889-73D026DB1D4B
OR
This issue covers following CVEs related to polymorphic deserialization, gadgets:

CVE-2018-19360 (axis2-transport-jms)
CVE-2018-19361 (openjpa)
CVE-2018-19362 (jboss-common-core)

See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Original vulnerability discoverer:
吴桂雄 Wuguixiong

Fixed in:

* 2.9.8 and later
* 2.8.11.3
* 2.7.9.5
* 2.6.7.3


Block more classes from polymorphic deserialization (CVE-2018-19360, CVE-2018-19361, CVE-2018-19362)
This is a GitHub Issue
repo:jackson-databind
owner:FasterXML
Title : Block more classes from polymorphic deserialization (CVE-2018-19360, CVE-2018-19361, CVE-2018-19362)
Issue date:

--- start body ---
This issue covers following CVEs related to polymorphic deserialization, gadgets:

CVE-2018-19360 (axis2-transport-jms)
CVE-2018-19361 (openjpa)
CVE-2018-19362 (jboss-common-core)

See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Original vulnerability discoverer:
吴桂雄 Wuguixiong

Fixed in:

* 2.9.8 and later
* 2.8.11.3
* 2.7.9.5
* 2.6.7.3


--- end body ---

comments :
--- start comments ---

--- end comments ---