Red Hat Security AdvisoryRHSA-2018:0116
rh-eclipse46-jackson-databind security update
Released 2018-01-23 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-eclipse46-jackson-databind-2.6.3-2.6.el7, rh-eclipse46-jackson-databind-javadoc-2.6.3-2.6.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-eclipse46-jackson-databind-2.6.3-2.6.el7, rh-eclipse46-jackson-databind-javadoc-2.6.3-2.6.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-eclipse46-jackson-databind-2.6.3-2.6.el7, rh-eclipse46-jackson-databind-javadoc-2.6.3-2.6.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-eclipse46-jackson-databind-2.6.3-2.6.el7, rh-eclipse46-jackson-databind-javadoc-2.6.3-2.6.el7
Fixes 1 record
Priority HIGH 80
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.49727 · Published 2018-01-10 · Partial fix · 2.9.4, 2.8.11 +1 CWE-502
