FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
7036DA13-110D-40B3-8494-E361BBF4AFCD
2.6.7.3
2.0.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
B99066EB-FF79-4D9D-9466-B04AD4D3A814
2.7.9.5
2.7.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
F4D3858C-DAF3-4522-90EC-EFCD13BD121E
2.8.11.3
2.8.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
4DA01839-5250-43A7-AFB7-871DC9B8AB32
2.9.7
2.9.0
OR
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
DEECE5FC-CACF-4496-A3E7-164736409252
OR
cpe:2.3:a:oracle:banking_platform:2.5.0:*:*:*:*:*:*:*
35AD0C07-9688-4397-8D45-FBB88C0F0C11
cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*
8972497F-6E24-45A9-9A18-EB0E842CB1D4
cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*
400509A8-D6F2-432C-A2F1-AD5B8778D0D9
cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*
132CE62A-FBFC-4001-81EC-35D81F73AF48
cpe:2.3:a:oracle:business_process_management_suite:12.1.3.0.0:*:*:*:*:*:*:*
B887E174-57AB-449D-AEE4-82DD1A3E5C84
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*
E869C417-C0E6-4FC3-B406-45598A1D1906
cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5:*:*:*:*:*:*:*
E6039DC7-08F2-4DD9-B5B5-B6B22DD2409F
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0:*:*:*:*:*:*:*
7231AF76-3D46-41C4-83E9-6E9E12940BD9
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.3.0:*:*:*:*:*:*:*
FD945A04-174C-46A2-935D-4F92631D1018
cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.2.2:*:*:*:*:*:*:*
A9E97F04-00ED-48E9-AB40-7A02B3419641
cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.2.3:*:*:*:*:*:*:*
FCCE5A11-39E7-4BBB-9E1A-BA4B754103BB
cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.3.1:*:*:*:*:*:*:*
A5AEC7F5-C353-4CF5-96CE-8C713A2B0C92
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.2:*:*:*:*:*:*:*
BB79BB43-E0AB-4F0D-A6EA-000485757EEC
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.3:*:*:*:*:*:*:*
F238CB66-886D-47E8-8DC0-7FC2025771EB
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.4:*:*:*:*:*:*:*
59B7B8AD-1210-4C40-8EF7-E2E8156630A1
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.5:*:*:*:*:*:*:*
0DE4A291-4358-42A9-A68D-E59D9998A1CC
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.6:*:*:*:*:*:*:*
0D19CF00-FE20-4690-AAB7-8E9DBC68A94F
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7:*:*:*:*:*:*:*
A030A498-3361-46F8-BB99-24A66CAE11CA
cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*
F6455EB1-C741-45E8-A53E-E7AD7A5D00EE
11.2.0.3.23
cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*
BFD43191-E67F-4D1B-967B-3C7B20331945
12.2.0.1.19
12.2.0.1.0
cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*
062C588A-CBBA-470F-8D11-2F961922E927
13.9.4.2.1
13.9.4.0.0
cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:9.2:*:*:*:*:*:*:*
989598A3-7012-4F57-B172-02404E20D16D
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*
41684398-18A4-4DC6-B8A2-3EBAA0CBF9A6
cpe:2.3:a:oracle:jdeveloper:12.1.3.0.0:*:*:*:*:*:*:*
042C243F-EDFE-4A04-AB0B-26E73CC34837
cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:*
228DA523-4D6D-48C5-BDB0-DB1A60F23F8B
cpe:2.3:a:oracle:nosql_database:*:*:*:*:*:*:*:*
63C59FA7-F321-4475-9F71-D78E0C890866
19.3.12
cpe:2.3:a:oracle:nosql_database:19.3.12:*:*:*:*:*:*:*
9E215743-2B5D-4EA5-A8F5-BBEC4DC85C35
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*
7A1E1023-2EB9-4334-9B74-CA71480F71C2
17.12
17.7
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:15.1:*:*:*:*:*:*:*
93A4E178-0082-45C5-BBC0-0A4E51C8B1DE
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:15.2:*:*:*:*:*:*:*
3F021C23-AB9B-4877-833F-D01359A98762
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:16.1:*:*:*:*:*:*:*
2F8ED016-32A1-42EE-844E-3E6B2C116B74
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:16.2:*:*:*:*:*:*:*
A046CC2C-445F-4336-8810-930570B4FEC6
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:18.8:*:*:*:*:*:*:*
0745445C-EC43-4091-BA7C-5105AFCC6F1F
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*
08FA59A8-6A62-4B33-8952-D6E658F8DAC9
17.12
17.7
cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*
D55A54FD-7DD1-49CD-BE81-0BE73990943C
cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*
82EB08C0-2D46-4635-88DF-E54F6452D3A3
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*
202AD518-2E9B-4062-B063-9858AE1F9CE2
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:*:*:*:*:*:*:*
A7FBF5C7-EC73-4CE4-8CB7-E9CF5705DB25
cpe:2.3:a:oracle:retail_merchandising_system:15.0:*:*:*:*:*:*:*
792DF04A-2D1B-40B5-B960-3E7152732EB8
cpe:2.3:a:oracle:retail_merchandising_system:16.0:*:*:*:*:*:*:*
46525CA6-4226-4F6F-B899-D800D4DDE0B5
cpe:2.3:a:oracle:retail_workforce_management_software:1.60.9.0.0:*:*:*:*:*:*:*
9967AAFD-2199-4668-9105-207D4866B707
cpe:2.3:a:oracle:siebel_engineering_-_installer_\&_deployment:*:*:*:*:*:*:*:*
25993ED6-D4C7-4B68-9F87-274B757A88CC
19.8
cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*
2F10FB4D-A29B-42B4-B70E-EB82A93F2218
19.10
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
D6A4F71A-4269-40FC-8F61-1D1301F2B728
OR
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
5735E553-9731-4AAC-BCFF-989377F817B3
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
BDFB1169-41A0-4A86-8E4F-FDA9730B1E94
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
E94F7F59-1785-493F-91A7-5F5EA5E87E4D
OR
cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*
3A76E5BF-01E4-46E7-8E3B-5ACE75657360
3.11.153
3.11
cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*
E9A6D103-9674-4B04-8397-86501F1D91CF
4.6.26
4.6
cpe:2.3:a:redhat:openshift_container_platform:3.10:*:*:*:*:*:*:*
4DBCD38F-BBE8-488C-A8C3-5782F191D915
OR
cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*
D2452F48-6A8B-4274-B0CE-F1256F400170
4.1.18
4.1
OR
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
142AD0DD-4CF3-4D74-9442-459CE3347E3A
OR
AND
This issue covers following CVEs related to polymorphic deserialization, gadgets:

* CVE-2018-14718: RCE with slf4j-ext jar
* CVE-2018-14719: RCE with blaze-ds-opt, -core jars
* CVE-2018-14720: exfiltration/XXE with only JDK classes (some JDK versions)
* CVE-2018-14721: exfiltration/SSRF with axis2-jaxws

Original vulnerability discoverer:
吴桂雄  Wuguixiong

-----

Fixed in:

* 2.9.7 and later
* 2.8.11.3
* 2.7.9.5
* 2.6.7.3

Block more classes from polymorphic deserialization (CVE-2018-14718 - CVE-2018-14721)
This is a GitHub Issue
repo:jackson-databind
owner:FasterXML
Title : Block more classes from polymorphic deserialization (CVE-2018-14718 - CVE-2018-14721)
Issue date:

--- start body ---
This issue covers following CVEs related to polymorphic deserialization, gadgets:

* CVE-2018-14718: RCE with slf4j-ext jar
* CVE-2018-14719: RCE with blaze-ds-opt, -core jars
* CVE-2018-14720: exfiltration/XXE with only JDK classes (some JDK versions)
* CVE-2018-14721: exfiltration/SSRF with axis2-jaxws

Original vulnerability discoverer:
吴桂雄  Wuguixiong

-----

Fixed in:

* 2.9.7 and later
* 2.8.11.3
* 2.7.9.5
* 2.6.7.3

--- end body ---

comments :
--- start comments ---

--- end comments ---