FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5…
Priority HIGH 67CWE-184Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 15 fixed, 16 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.19781 97th percentileScored 2026-11-07
Fix Partial com.fasterxml.jackson.core:jackson-databind (Maven): 2.8.11.1, 2.9.5, 2.7.9.3 +1Red Hat: 14 advisoriesRed Hat: 15 fixed, 16 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.8.0 to before 2.8.11.1 | 2.8.11.1 | Patch available | GHSA-cggj-fvv3-cqwv |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.9.0 to before 2.9.5 | 2.9.5 | Patch available | GHSA-cggj-fvv3-cqwv |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.7.0 to before 2.7.9.3 | 2.7.9.3 | Patch available | GHSA-cggj-fvv3-cqwv |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | before 2.6.7.5 | 2.6.7.5 | Patch available | GHSA-cggj-fvv3-cqwv |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.8.0 to before 2.8.11.1 Fixed in 2.8.11.1 Patch available GHSA-cggj-fvv3-cqwv
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.9.0 to before 2.9.5 Fixed in 2.9.5 Patch available GHSA-cggj-fvv3-cqwv
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.7.0 to before 2.7.9.3 Fixed in 2.7.9.3 Patch available GHSA-cggj-fvv3-cqwv
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected before 2.6.7.5 Fixed in 2.6.7.5 Patch available GHSA-cggj-fvv3-cqwv
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* | before 2.7.9.3; 2.8.0 to before 2.8.11.1; 2.9.0 to before 2.9.5 | Vulnerable | FasterXML |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5:*:*:*:*:*:*:* | 7.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0:*:*:*:*:*:*:* | 12.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1:*:*:*:*:*:*:* | 10.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.19:*:*:*:*:*:*:* | 6.4.19 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.2:*:*:*:*:*:*:* | 7.1.2 | Vulnerable | Red Hat |
- cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions before 2.7.9.3; 2.8.0 to before 2.8.11.1; 2.9.0 to before 2.9.5 Vulnerable ·FasterXML
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5:*:*:*:*:*:*:* Versions 7.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1:*:*:*:*:*:*:* Versions 10.0.1 Vulnerable ·Oracle
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.19:*:*:*:*:*:*:* Versions 6.4.19 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.2:*:*:*:*:*:*:* Versions 7.1.2 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-cggj-fvv3-cqwv com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.8.11.1 Advisory →
- Fix · GHSA-cggj-fvv3-cqwv com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.9.5 Advisory →
- Fix · GHSA-cggj-fvv3-cqwv com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.7.9.3 Advisory →
- Fix · GHSA-cggj-fvv3-cqwv com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.6.7.5 Advisory →
Red Hat 14 advisories
- RHSA-2020:2562 Released 2020-06-15 · Red Hat rating ImportantEAP Continuous Delivery Technical Preview Release 13 security update
- Red Hat JBoss Enterprise Application Platform Continuous Delivery
- RHSA-2019:3149 Released 2019-10-18 · Red Hat rating ImportantOpenShift Container Platform logging-elasticsearch5-container security update
- Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5
- RHSA-2019:2858 Released 2019-09-27 · Red Hat rating ImportantOpenShift Container Platform 4.1.18 logging-elasticsearch5 security update
- Red Hat OpenShift Container Platform 4.1 openshift4/ose-logging-elasticsearch5
Show 11 more Red Hat advisories
- RHSA-2018:2939 Released 2018-10-17 · Red Hat rating CriticalRed Hat FIS 2.0 on Fuse 6.3.0 R8 security and bug fix update
- Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R8
- RHSA-2018:2938 Released 2018-10-17 · Red Hat rating ModerateRed Hat OpenShift Application Runtimes Thorntail 2.2.0 security & bug fix update
- Text-Only RHOAR
- RHSA-2018:2089 Released 2018-06-27 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform security update
- Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-activemq-artemis-1.5.5.012-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.012-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.012-1.redhat_1.1.ep7.el7 +47
- RHSA-2018:2090 Released 2018-06-27 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform security update
- Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-activemq-artemis-1.5.5.012-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.5.5.012-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.5.5.012-1.redhat_1.1.ep7.el6 +47
- RHSA-2018:2088 Released 2018-06-27 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.1.3 security update
- Red Hat JBoss EAP 7.1
- RHSA-2018:1786 Released 2018-06-04 · Red Hat rating ModerateRed Hat OpenShift Application Runtimes security and bug fix update
- Red Hat Openshift Application Runtimes
- RHSA-2018:1451 Released 2018-05-14 · Red Hat rating Importanteap6-jboss-ec2-eap security update
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server jboss-ec2-eap-7.5.20-1.Final_redhat_1.ep6.el6, jboss-ec2-eap-samples-7.5.20-1.Final_redhat_1.ep6.el6
- RHSA-2018:1449 Released 2018-05-14 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.20 security update
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server codehaus-jackson-1.9.9-12.redhat_6.1.ep6.el6, codehaus-jackson-core-asl-1.9.9-12.redhat_6.1.ep6.el6, codehaus-jackson-jaxrs-1.9.9-12.redhat_6.1.ep6.el6 +47
- RHSA-2018:1450 Released 2018-05-14 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.20 security update
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server codehaus-jackson-1.9.9-12.redhat_6.1.ep6.el5, codehaus-jackson-core-asl-1.9.9-12.redhat_6.1.ep6.el5, codehaus-jackson-jaxrs-1.9.9-12.redhat_6.1.ep6.el5 +47
- RHSA-2018:1448 Released 2018-05-14 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.20 security update
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server codehaus-jackson-1.9.9-12.redhat_6.1.ep6.el7, codehaus-jackson-core-asl-1.9.9-12.redhat_6.1.ep6.el7, codehaus-jackson-jaxrs-1.9.9-12.redhat_6.1.ep6.el7 +47
- RHSA-2018:1447 Released 2018-05-14 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.20 security update
- Red Hat JBoss Enterprise Application Platform 6.4
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix yet |
| Red Hat Fuse 7 | Affected | No fix yet |
| Red Hat JBoss A-MQ 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss BRMS 6 | Affected | No fix yet |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse Integration Service 2 | Affected | No fix yet |
| Red Hat JBoss Operations Network 3 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.10 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.6 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.7 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.9 | Affected | No fix yet |
| Red Hat OpenShift Enterprise 2 | Affected | No fix planned: Out of support scope |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| Red Hat Subscription Asset Manager | Affected | No fix planned: Will not fix |
| Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R8 | Fixed | RHSA-2018:2939 |
| Red Hat JBoss EAP 7.1 | Fixed | RHSA-2018:2088 |
| Red Hat JBoss Enterprise Application Platform 6.4 | Fixed | RHSA-2018:1447 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server | Fixed | RHSA-2018:1450 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server | Fixed | RHSA-2018:1449, RHSA-2018:1451 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server | Fixed | RHSA-2018:1448 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server | Fixed | RHSA-2018:2090 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server | Fixed | RHSA-2018:2089 |
| Red Hat JBoss Enterprise Application Platform Continuous Delivery | Fixed | RHSA-2020:2562 |
| Red Hat OpenShift Container Platform 3.11 | Fixed | RHSA-2019:3149 |
| Red Hat OpenShift Container Platform 4.1 | Fixed | RHSA-2019:2858 |
| Red Hat Openshift Application Runtimes | Fixed | RHSA-2018:1786 |
| Red Hat Virtualization 4 Hypervisor for RHEL 7 | Fixed | — |
| Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts | Fixed | — |
| Text-Only RHOAR | Fixed | RHSA-2018:2938 |
Not affected: 3 products
- Red Hat JBoss Data Grid 7
- Red Hat Mobile Application Platform 4
- Red Hat Satellite 6
Timeline
- 2026-10-02 Threatist record created from CVE-2018-7489
- 2026-10-03 Alias added: GHSA-cggj-fvv3-cqwv
- 2026-10-16 CISA SSVC decision points changed
- 2026-10-16 Priority changed: MEDIUM → HIGH
References
Patch 6
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Advisory 19
- RHSA-2018:1448
- RHSA-2018:1449
- RHSA-2018:2938
- RHSA-2018:1450
- RHSA-2018:2090
- RHSA-2018:2939
- RHSA-2018:1786
- RHSA-2018:1451
- DSA-4190
- RHSA-2018:1447
- RHSA-2018:2088
- RHSA-2018:2089
- RHSA-2019:2858
- RHSA-2019:3149
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us
- https://security.netapp.com/advisory/ntap-20180328-0001/
- https://github.com/FasterXML/jackson-databind/issues/1931
- https://nvd.nist.gov/vuln/detail/CVE-2018-7489
- https://github.com/advisories/GHSA-cggj-fvv3-cqwv
Other 10
- https://www.oracle.com/security-alerts/cpuoct2020.html
- [druid-commits] 20210324 [GitHub] [druid] jihoonson opened a new pull request #11030: Suppress cves
- https://github.com/FasterXML/jackson-databind/commit/e66c0a9d3c926ff1b63bf586c824ead1d02f2a3d
- https://github.com/FasterXML/jackson-databind/commit/ca2bfc86af82a1479112004b663ba74c760752e6
- https://github.com/FasterXML/jackson-databind/commit/c921f0935d5e41bf206e702d8077a275ba1a6efc
- https://github.com/FasterXML/jackson-databind/commit/6799f8f10cc78e9af6d443ed6982d00a13f2e7d2
- https://github.com/FasterXML/jackson-databind/commit/bc22f90eb7f896ace9567598a99cb1ff6e0f9d9d
- https://security.netapp.com/advisory/ntap-20180328-0001
- https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1@%3Ccommits.druid.apache.org%3E
- https://github.com/FasterXML/jackson-databind
Sources
- CVE-2018-7489 · CVE Program
- CVE-2018-7489 · NVD
- FIRST EPSS
- GHSA-cggj-fvv3-cqwv · GitHub Advisory Database · CC BY 4.0
- CVE-2018-7489 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences