An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
7036DA13-110D-40B3-8494-E361BBF4AFCD
2.6.7.3
2.0.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
44F16CE8-7CAD-4846-A38E-8192D56AB09B
2.7.9.4
2.7.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
02EA57F3-507D-4E70-BA77-D235A59C2800
2.8.11.2
2.8.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
429C17F2-AB58-4BC0-8EB0-AF3322DDD528
2.9.6
2.9.0
OR
cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*
2F87326E-0B56-4356-A889-73D026DB1D4B
OR
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
142AD0DD-4CF3-4D74-9442-459CE3347E3A
OR
cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*
064E7BDD-4EF0-4A0D-A38D-8C75BAFEDCEF
OR
AND
cpe:2.3:a:oracle:clusterware:12.1.0.2.0:*:*:*:*:*:*:*
6C9084DB-329E-403F-8D0A-5B9F53183714
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.2.0:*:*:*:*:*:*:*
9615B3B8-B176-4359-97B5-D2E2FEE5BFEA
cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*
F6455EB1-C741-45E8-A53E-E7AD7A5D00EE
11.2.0.3.23
cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*
BFD43191-E67F-4D1B-967B-3C7B20331945
12.2.0.1.19
12.2.0.1.0
cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*
062C588A-CBBA-470F-8D11-2F961922E927
13.9.4.2.1
13.9.4.0.0
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:*:*:*:*:*:*:*
A7FBF5C7-EC73-4CE4-8CB7-E9CF5705DB25
cpe:2.3:a:oracle:utilities_advanced_spatial_and_operational_analytics:2.7.0.1:*:*:*:*:*:*:*
6FD0EC40-B96B-4E9C-9A81-4E65C4B9512E
OR
A new potential gadget type from MyBatis (https://github.com/mybatis/mybatis-3) has been reported. It may allow content exfiltration (remote access by sending contents over ftp) when untrusted content is deserialized with default typing enabled.
See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Mitre id: CVE-2018-11307

Original vulnerability discoverer:
吴桂雄  Wuguixiong

Fixed in

* 2.9.5 and later
* 2.8.11.2
* 2.7.9.4
* 2.6.7.3

Block one more gadget type (mybatis, CVE-2018-11307)
This is a GitHub Issue
repo:jackson-databind
owner:FasterXML
Title : Block one more gadget type (mybatis, CVE-2018-11307)
Issue date:

--- start body ---
A new potential gadget type from MyBatis (https://github.com/mybatis/mybatis-3) has been reported. It may allow content exfiltration (remote access by sending contents over ftp) when untrusted content is deserialized with default typing enabled.
See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Mitre id: CVE-2018-11307

Original vulnerability discoverer:
吴桂雄  Wuguixiong

Fixed in

* 2.9.5 and later
* 2.8.11.2
* 2.7.9.4
* 2.6.7.3

--- end body ---

comments :
--- start comments ---

--- end comments ---