An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5.
Priority MEDIUM 57CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 19 fixed, 9 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0573 93rd percentileScored 2026-11-07
Fix Partial com.fasterxml.jackson.core:jackson-databind (Maven): 2.7.9.4, 2.8.11.2, 2.9.6Red Hat: 15 advisoriesRed Hat: 19 fixed, 9 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.0.0 to before 2.7.9.4 | 2.7.9.4 | Patch available | GHSA-qr7j-h6gg-jmgc |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.8.0 to before 2.8.11.2 | 2.8.11.2 | Patch available | GHSA-qr7j-h6gg-jmgc |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.9.0 to before 2.9.6 | 2.9.6 | Patch available | GHSA-qr7j-h6gg-jmgc |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.0.0 to before 2.7.9.4 Fixed in 2.7.9.4 Patch available GHSA-qr7j-h6gg-jmgc
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.8.0 to before 2.8.11.2 Fixed in 2.8.11.2 Patch available GHSA-qr7j-h6gg-jmgc
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.9.0 to before 2.9.6 Fixed in 2.9.6 Patch available GHSA-qr7j-h6gg-jmgc
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* | 2.0.0 to before 2.6.7.3; 2.7.0 to before 2.7.9.4; 2.8.0 to before 2.8.11.2; 2.9.0 to before 2.9.6 | Vulnerable | FasterXML |
| cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* | 3.11 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:* | 4.1 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Running on | Red Hat |
| cpe:2.3:a:oracle:clusterware:12.1.0.2.0:*:*:*:*:*:*:* | 12.1.0.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.2.0:*:*:*:*:*:*:* | 10.0.1.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:* | before 11.2.0.3.23; 12.2.0.1.0 to before 12.2.0.1.19; 13.9.4.0.0 to before 13.9.4.2.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:*:*:*:*:*:*:* | 17.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_advanced_spatial_and_operational_analytics:2.7.0.1:*:*:*:*:*:*:* | 2.7.0.1 | Vulnerable | Oracle |
- cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.6.7.3; 2.7.0 to before 2.7.9.4; 2.8.0 to before 2.8.11.2; 2.9.0 to before 2.9.6 Vulnerable ·FasterXML
- cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
- cpe:2.3:a:oracle:clusterware:12.1.0.2.0:*:*:*:*:*:*:* Versions 12.1.0.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.2.0:*:*:*:*:*:*:* Versions 10.0.1.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:* Versions before 11.2.0.3.23; 12.2.0.1.0 to before 12.2.0.1.19; 13.9.4.0.0 to before 13.9.4.2.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:*:*:*:*:*:*:* Versions 17.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_advanced_spatial_and_operational_analytics:2.7.0.1:*:*:*:*:*:*:* Versions 2.7.0.1 Vulnerable ·Oracle
Remediation
- Fix · GHSA-qr7j-h6gg-jmgc com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.7.9.4 Advisory →
- Fix · GHSA-qr7j-h6gg-jmgc com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.8.11.2 Advisory →
- Fix · GHSA-qr7j-h6gg-jmgc com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.9.6 Advisory →
Red Hat 15 advisories
- RHSA-2019:4037 Released 2019-12-02 · Red Hat rating ImportantRed Hat Data Grid 7.3.2 security update
- Red Hat Data Grid
- RHSA-2019:3892 Released 2019-11-14 · Red Hat rating ImportantRed Hat Fuse 7.5.0 security update
- Red Hat Fuse 7.5.0
- RHSA-2019:3149 Released 2019-10-18 · Red Hat rating ImportantOpenShift Container Platform logging-elasticsearch5-container security update
- Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5
Show 12 more Red Hat advisories
- RHSA-2019:3140 Released 2019-10-17 · Red Hat rating ImportantRed Hat JBoss Data Virtualization 6.4.8 security update
- Red Hat JBoss Data Virtualization 6.4.8
- RHSA-2019:3002 Released 2019-10-10 · Red Hat rating ImportantRed Hat FIS 2.0 on Fuse 6.3.0 R13 security and bug fix update
- Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R13
- RHSA-2019:2858 Released 2019-09-27 · Red Hat rating ImportantOpenShift Container Platform 4.1.18 logging-elasticsearch5 security update
- Red Hat OpenShift Container Platform 4.1 openshift4/ose-logging-elasticsearch5
- RHSA-2019:2804 Released 2019-09-17 · Red Hat rating ImportantRed Hat JBoss Fuse/A-MQ 6.3 R13 security and bug fix update
- Red Hat Fuse 6.3
- RHSA-2019:1822 Released 2019-07-22 · Red Hat rating ImportantRed Hat Decision Manager 7.4.0 Security Update
- Red Hat JBoss BRMS 7.4
- RHSA-2019:1823 Released 2019-07-22 · Red Hat rating ImportantRed Hat Process Automation Manager 7.4.0 Security Update
- Red Hat JBoss BPMS 7.4
- RHSA-2019:1140 Released 2019-05-09 · Red Hat rating ImportantRed Hat Single Sign-On 7.3.1 security update
- Red Hat Single Sign-On 7.3.1 zip
- RHSA-2019:1108 Released 2019-05-08 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.1 on RHEL 7 security update
- Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-activemq-artemis-2.6.3-5.redhat_00020.1.el7eap, eap7-activemq-artemis-cli-2.6.3-5.redhat_00020.1.el7eap, eap7-activemq-artemis-commons-2.6.3-5.redhat_00020.1.el7eap +47
- RHSA-2019:1107 Released 2019-05-08 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.1 on RHEL 6 security update
- Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-activemq-artemis-2.6.3-5.redhat_00020.1.el6eap, eap7-activemq-artemis-cli-2.6.3-5.redhat_00020.1.el6eap, eap7-activemq-artemis-commons-2.6.3-5.redhat_00020.1.el6eap +47
- RHSA-2019:1106 Released 2019-05-08 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.1 security update
- Red Hat JBoss EAP 7.2
- RHSA-2019:0877 Released 2019-04-24 · Red Hat rating ImportantRed Hat OpenShift Application Runtimes Thorntail 2.4.0 security & bug fix update
- Text-Only RHOAR
- RHSA-2019:0782 Released 2019-04-17 · Red Hat rating Importantrh-maven35-jackson-databind security update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix yet |
| Red Hat JBoss A-MQ 6 | Affected | No fix yet |
| Red Hat JBoss BRMS 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse Integration Service 2 | Affected | No fix yet |
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.10 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.6 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.7 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.9 | Affected | No fix yet |
| Red Hat Data Grid | Fixed | RHSA-2019:4037 |
| Red Hat Fuse 6.3 | Fixed | RHSA-2019:2804 |
| Red Hat Fuse 7.5.0 | Fixed | RHSA-2019:3892 |
| Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R13 | Fixed | RHSA-2019:3002 |
| Red Hat JBoss BPMS 7.4 | Fixed | RHSA-2019:1823 |
| Red Hat JBoss BRMS 7.4 | Fixed | RHSA-2019:1822 |
| Red Hat JBoss Data Virtualization 6.4.8 | Fixed | RHSA-2019:3140 |
| Red Hat JBoss EAP 7.2 | Fixed | RHSA-2019:1106 |
| Red Hat JBoss EAP 7.2 for RHEL 6 Server | Fixed | RHSA-2019:1107 |
| Red Hat JBoss EAP 7.2 for RHEL 7 Server | Fixed | RHSA-2019:1108 |
| Red Hat OpenShift Container Platform 3.11 | Fixed | RHSA-2019:3149 |
| Red Hat OpenShift Container Platform 4.1 | Fixed | RHSA-2019:2858 |
| Red Hat Single Sign-On 7.3.1 zip | Fixed | RHSA-2019:1140 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2019:0782 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) | Fixed | RHSA-2019:0782 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) | Fixed | RHSA-2019:0782 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) | Fixed | RHSA-2019:0782 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2019:0782 |
| Text-Only RHOAR | Fixed | RHSA-2019:0877 |
Not affected: 13 products
- Red Hat Enterprise Linux 8
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Operations Network 3
- Red Hat Mobile Application Platform 4
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenStack Platform 10 (Newton)
- Red Hat OpenStack Platform 13 (Queens)
- Red Hat OpenStack Platform 14 (Rocky)
- Red Hat OpenStack Platform 8 (Liberty)
- Red Hat OpenStack Platform 9 (Mitaka)
- Red Hat Satellite 6
- Red Hat Subscription Asset Manager
- Red Hat Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2018-11307
- 2026-10-03 Alias added: GHSA-qr7j-h6gg-jmgc
- 2026-10-08 CISA SSVC decision points changed
References
Advisory 21
- RHSA-2019:1822
- RHSA-2019:1823
- RHSA-2019:2804
- RHSA-2019:2858
- [lucene-issues] 20191004 [GitHub] [lucene-solr] marungo opened a new pull request #925: SOLR-13818: Upgrade jackson to 2.10.0
- RHSA-2019:3002
- RHSA-2019:3140
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities
- RHSA-2019:3149
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- RHSA-2019:3892
- RHSA-2019:4037
- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-7525
- https://access.redhat.com/errata/RHSA-2019:0782
- https://github.com/FasterXML/jackson-databind/issues/2032
- https://nvd.nist.gov/vuln/detail/CVE-2018-11307
Other 9
- https://github.com/FasterXML/jackson-databind/commit/051bd5e447fbc9539e12a4fe90eb989dba0c656
- https://github.com/FasterXML/jackson-databind/commit/27b4defc270454dea6842bd9279f17387eceb73
- https://github.com/FasterXML/jackson-databind/commit/78e78738d69adcb59fdac9fc12d9053ce8809f3d
- https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d@%3Cissues.lucene.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://github.com/FasterXML/jackson-databind
Sources
- CVE-2018-11307 · CVE Program
- CVE-2018-11307 · NVD
- FIRST EPSS
- GHSA-qr7j-h6gg-jmgc · GitHub Advisory Database · CC BY 4.0
- CVE-2018-11307 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences