An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and…
Priority MEDIUM 45CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 21 fixed, 7 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.07289 94th percentileScored 2026-11-07
Fix Partial com.fasterxml.jackson.core:jackson-databind (Maven): 2.7.9.4, 2.8.11.2, 2.9.6Red Hat: 17 advisoriesRed Hat: 21 fixed, 7 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | before 2.7.9.4 | 2.7.9.4 | Patch available | GHSA-cjjf-94ff-43w7 |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.8.0 to before 2.8.11.2 | 2.8.11.2 | Patch available | GHSA-cjjf-94ff-43w7 |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.9.0 to before 2.9.6 | 2.9.6 | Patch available | GHSA-cjjf-94ff-43w7 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected before 2.7.9.4 Fixed in 2.7.9.4 Patch available GHSA-cjjf-94ff-43w7
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.8.0 to before 2.8.11.2 Fixed in 2.8.11.2 Patch available GHSA-cjjf-94ff-43w7
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.9.0 to before 2.9.6 Fixed in 2.9.6 Patch available GHSA-cjjf-94ff-43w7
CPE configurations NVD · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* | 2.0.0 to before 2.6.7.3; 2.7.0 to before 2.7.9.4; 2.8.0 to before 2.8.11.2; 2.9.0 to before 2.9.6 | Vulnerable | FasterXML |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* | 29 | Vulnerable | Fedoraproject |
| cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:* | 9.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_merchandising_system:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | Oracle |
| cpe:2.3:a:redhat:automation_manager:7.3.1:*:*:*:*:*:*:* | 7.3.1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:decision_manager:7.3.1:*:*:*:*:*:*:* | 7.3.1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_brms:6.4.10:*:*:*:*:*:*:* | 6.4.10 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:* | 7.2.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* | 3.11 | Vulnerable | Red Hat |
- cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.6.7.3; 2.7.0 to before 2.7.9.4; 2.8.0 to before 2.8.11.2; 2.9.0 to before 2.9.6 Vulnerable ·FasterXML
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
- cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_merchandising_system:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
- cpe:2.3:a:redhat:automation_manager:7.3.1:*:*:*:*:*:*:* Versions 7.3.1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:decision_manager:7.3.1:*:*:*:*:*:*:* Versions 7.3.1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_brms:6.4.10:*:*:*:*:*:*:* Versions 6.4.10 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:* Versions 7.2.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-cjjf-94ff-43w7 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.7.9.4 Advisory →
- Fix · GHSA-cjjf-94ff-43w7 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.8.11.2 Advisory →
- Fix · GHSA-cjjf-94ff-43w7 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.9.6 Advisory →
Red Hat 17 advisories
- RHSA-2019:4037 Released 2019-12-02 · Red Hat rating ImportantRed Hat Data Grid 7.3.2 security update
- Red Hat Data Grid
- RHSA-2019:3892 Released 2019-11-14 · Red Hat rating ImportantRed Hat Fuse 7.5.0 security update
- Red Hat Fuse 7.5.0
- RHSA-2019:3149 Released 2019-10-18 · Red Hat rating ImportantOpenShift Container Platform logging-elasticsearch5-container security update
- Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5
Show 14 more Red Hat advisories
- RHSA-2019:3140 Released 2019-10-17 · Red Hat rating ImportantRed Hat JBoss Data Virtualization 6.4.8 security update
- Red Hat JBoss Data Virtualization 6.4.8
- RHSA-2019:3002 Released 2019-10-10 · Red Hat rating ImportantRed Hat FIS 2.0 on Fuse 6.3.0 R13 security and bug fix update
- Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R13
- RHSA-2019:2858 Released 2019-09-27 · Red Hat rating ImportantOpenShift Container Platform 4.1.18 logging-elasticsearch5 security update
- Red Hat OpenShift Container Platform 4.1 openshift4/ose-logging-elasticsearch5
- RHSA-2019:2804 Released 2019-09-17 · Red Hat rating ImportantRed Hat JBoss Fuse/A-MQ 6.3 R13 security and bug fix update
- Red Hat Fuse 6.3
- RHSA-2019:1822 Released 2019-07-22 · Red Hat rating ImportantRed Hat Decision Manager 7.4.0 Security Update
- Red Hat JBoss BRMS 7.4
- RHSA-2019:1823 Released 2019-07-22 · Red Hat rating ImportantRed Hat Process Automation Manager 7.4.0 Security Update
- Red Hat JBoss BPMS 7.4
- RHSA-2019:1797 Released 2019-07-16 · Red Hat rating ImportantRed Hat JBoss BPM Suite 6.4.12 security update
- Red Hat JBoss BPMS 6.4
- RHSA-2019:1782 Released 2019-07-15 · Red Hat rating ImportantRed Hat JBoss BRMS 6.4.12 security update
- Red Hat JBoss BRMS 6.4.12
- RHSA-2019:1140 Released 2019-05-09 · Red Hat rating ImportantRed Hat Single Sign-On 7.3.1 security update
- Red Hat Single Sign-On 7.3.1 zip
- RHSA-2019:1108 Released 2019-05-08 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.1 on RHEL 7 security update
- Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-activemq-artemis-2.6.3-5.redhat_00020.1.el7eap, eap7-activemq-artemis-cli-2.6.3-5.redhat_00020.1.el7eap, eap7-activemq-artemis-commons-2.6.3-5.redhat_00020.1.el7eap +47
- RHSA-2019:1107 Released 2019-05-08 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.1 on RHEL 6 security update
- Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-activemq-artemis-2.6.3-5.redhat_00020.1.el6eap, eap7-activemq-artemis-cli-2.6.3-5.redhat_00020.1.el6eap, eap7-activemq-artemis-commons-2.6.3-5.redhat_00020.1.el6eap +47
- RHSA-2019:1106 Released 2019-05-08 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.1 security update
- Red Hat JBoss EAP 7.2
- RHSA-2019:0877 Released 2019-04-24 · Red Hat rating ImportantRed Hat OpenShift Application Runtimes Thorntail 2.4.0 security & bug fix update
- Text-Only RHOAR
- RHSA-2019:0782 Released 2019-04-17 · Red Hat rating Importantrh-maven35-jackson-databind security update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss A-MQ 6 | Affected | No fix yet |
| Red Hat JBoss Fuse Integration Service 2 | Affected | No fix yet |
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.10 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.6 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.7 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.9 | Affected | No fix yet |
| Red Hat Data Grid | Fixed | RHSA-2019:4037 |
| Red Hat Fuse 6.3 | Fixed | RHSA-2019:2804 |
| Red Hat Fuse 7.5.0 | Fixed | RHSA-2019:3892 |
| Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R13 | Fixed | RHSA-2019:3002 |
| Red Hat JBoss BPMS 6.4 | Fixed | RHSA-2019:1797 |
| Red Hat JBoss BPMS 7.4 | Fixed | RHSA-2019:1823 |
| Red Hat JBoss BRMS 6.4.12 | Fixed | RHSA-2019:1782 |
| Red Hat JBoss BRMS 7.4 | Fixed | RHSA-2019:1822 |
| Red Hat JBoss Data Virtualization 6.4.8 | Fixed | RHSA-2019:3140 |
| Red Hat JBoss EAP 7.2 | Fixed | RHSA-2019:1106 |
| Red Hat JBoss EAP 7.2 for RHEL 6 Server | Fixed | RHSA-2019:1107 |
| Red Hat JBoss EAP 7.2 for RHEL 7 Server | Fixed | RHSA-2019:1108 |
| Red Hat OpenShift Container Platform 3.11 | Fixed | RHSA-2019:3149 |
| Red Hat OpenShift Container Platform 4.1 | Fixed | RHSA-2019:2858 |
| Red Hat Single Sign-On 7.3.1 zip | Fixed | RHSA-2019:1140 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2019:0782 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) | Fixed | RHSA-2019:0782 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) | Fixed | RHSA-2019:0782 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) | Fixed | RHSA-2019:0782 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2019:0782 |
| Text-Only RHOAR | Fixed | RHSA-2019:0877 |
Not affected: 13 products
- Red Hat Enterprise Linux 8
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Operations Network 3
- Red Hat Mobile Application Platform 4
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenStack Platform 10 (Newton)
- Red Hat OpenStack Platform 13 (Queens)
- Red Hat OpenStack Platform 14 (Rocky)
- Red Hat OpenStack Platform 8 (Liberty)
- Red Hat OpenStack Platform 9 (Mitaka)
- Red Hat Satellite 6
- Red Hat Subscription Asset Manager
- Red Hat Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2018-12022
- 2026-10-03 Alias added: GHSA-cjjf-94ff-43w7
- 2026-10-08 CISA SSVC decision points changed
References
Patch 4
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://github.com/FasterXML/jackson-databind/issues/2052
- https://github.com/FasterXML/jackson-databind/commit/28badf7ef60ac3e7ef151cd8e8ec010b8479226a
Advisory 27
- RHSA-2019:0782
- RHSA-2019:0877
- RHBA-2019:0959
- RHSA-2019:1107
- RHSA-2019:1108
- RHSA-2019:1106
- RHSA-2019:1140
- DSA-4452
- 20190527 [SECURITY] [DSA 4452-1] jackson-databind security update
- RHSA-2019:1782
- RHSA-2019:1797
- RHSA-2019:1822
- RHSA-2019:1823
- RHSA-2019:2804
- RHSA-2019:2858
- RHSA-2019:3002
- RHSA-2019:3140
- RHSA-2019:3149
- RHSA-2019:3892
- RHSA-2019:4037
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf
- https://security.netapp.com/advisory/ntap-20190530-0003/
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1671098
- https://nvd.nist.gov/vuln/detail/CVE-2018-12022
- https://github.com/advisories/GHSA-cjjf-94ff-43w7
Other 16
- [lucene-issues] 20191004 [GitHub] [lucene-solr] marungo opened a new pull request #925: SOLR-13818: Upgrade jackson to 2.10.0
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZEDLDUYBSTDY4GWDBUXGJNS2RFYTFVRC/
- https://github.com/FasterXML/jackson-databind/commit/7487cf7eb14be2f65a1eb108e8629c07ef45e0a
- https://github.com/FasterXML/jackson-databind/commit/bf261d404c2f79fd3406237710d40ebb03c99d84
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d@%3Cissues.lucene.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZEDLDUYBSTDY4GWDBUXGJNS2RFYTFVRC
- https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://security.netapp.com/advisory/ntap-20190530-0003
- https://github.com/FasterXML/jackson-databind
Sources
- CVE-2018-12022 · CVE Program
- CVE-2018-12022 · NVD
- FIRST EPSS
- GHSA-cjjf-94ff-43w7 · GitHub Advisory Database · CC BY 4.0
- CVE-2018-12022 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences