Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation…
Priority LOW 36CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 fixed, 4 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.
Why it matters now
EPSS 0.04758 91st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial com.fasterxml.jackson.datatype:jackson-datatype-jsr310 (Maven): 2.9.8Red Hat: 1 advisoryRed Hat: 1 fixed, 4 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | com.fasterxml.jackson.datatype:jackson-datatype-jsr310 (Maven) | before 2.9.8 | 2.9.8 | Patch available | GHSA-h4x4-5qp2-wp46 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- com.fasterxml.jackson.datatype:jackson-datatype-jsr310 (Maven) Vendor— Affected before 2.9.8 Fixed in 2.9.8 Patch available GHSA-h4x4-5qp2-wp46
CPE configurations NVD · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fasterxml:jackson-modules-java8:*:*:*:*:*:*:*:* | before 2.9.8 | Vulnerable | FasterXML |
| cpe:2.3:a:oracle:clusterware:12.1.0.2.0:*:*:*:*:*:*:* | 12.1.0.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:database_server:12.1.0.2:*:*:*:*:*:*:* | 12.1.0.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:database_server:12.2.0.1:*:*:*:*:*:*:* | 12.2.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:database_server:18c:*:*:*:*:*:*:* | 18c | Vulnerable | Oracle |
| cpe:2.3:a:oracle:database_server:19c:*:*:*:*:*:*:* | 19c | Vulnerable | Oracle |
| cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:* | before 11.2.0.3.23; 12.2.0.1.0 to before 12.2.0.1.19; 13.9.4.0.0 to before 13.9.4.2.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:nosql_database:*:*:*:*:*:*:*:* | before 19.3.12 | Vulnerable | Oracle |
| cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:linux:*:* | 7.3 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:* | 7.3 | Vulnerable | NetApp |
- cpe:2.3:a:fasterxml:jackson-modules-java8:*:*:*:*:*:*:*:* Versions before 2.9.8 Vulnerable ·FasterXML
- cpe:2.3:a:oracle:clusterware:12.1.0.2.0:*:*:*:*:*:*:* Versions 12.1.0.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:database_server:12.1.0.2:*:*:*:*:*:*:* Versions 12.1.0.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:database_server:12.2.0.1:*:*:*:*:*:*:* Versions 12.2.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:database_server:18c:*:*:*:*:*:*:* Versions 18c Vulnerable ·Oracle
- cpe:2.3:a:oracle:database_server:19c:*:*:*:*:*:*:* Versions 19c Vulnerable ·Oracle
- cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:* Versions before 11.2.0.3.23; 12.2.0.1.0 to before 12.2.0.1.19; 13.9.4.0.0 to before 13.9.4.2.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:nosql_database:*:*:*:*:*:*:*:* Versions before 19.3.12 Vulnerable ·Oracle
- cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:linux:*:* Versions 7.3 Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:* Versions 7.3 Vulnerable ·NetApp
Remediation
- Fix · GHSA-h4x4-5qp2-wp46 com.fasterxml.jackson.datatype:jackson-datatype-jsr310 (Maven) Fixed in 2.9.8 Advisory →
Red Hat 1 advisory
- RHSA-2020:5568 Released 2020-12-16 · Red Hat rating ImportantRed Hat Fuse 7.8.0 release and security update
- Red Hat Fuse 7.8.0
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet |
| Red Hat Mobile Application Platform 4 | Affected | No fix planned: Out of support scope |
| Red Hat Virtualization 4 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7.8.0 | Fixed | RHSA-2020:5568 |
Not affected: 17 products
- Red Hat BPM Suite 6
- Red Hat Decision Manager 7
- Red Hat Enterprise Linux 8
- Red Hat JBoss A-MQ 6
- Red Hat JBoss BRMS 6
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Fuse 6
- Red Hat JBoss Fuse Integration Service 2
- Red Hat JBoss Operations Network 3
- Red Hat OpenShift Application Runtimes
- Red Hat OpenShift Enterprise 2
- Red Hat Process Automation 7
- Red Hat Satellite 6
- Red Hat Single Sign-On 7
- Red Hat Software Collections
- Red Hat Subscription Asset Manager
Timeline
- 2026-10-02 Threatist record created from CVE-2018-1000873
- 2026-10-03 Alias added: GHSA-h4x4-5qp2-wp46
References
Advisory 8
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1665601
- https://security.netapp.com/advisory/ntap-20200904-0004/
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000873
- https://github.com/advisories/GHSA-h4x4-5qp2-wp46
Other 14
- [pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html
- [nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html
- https://security.netapp.com/advisory/ntap-20200904-0004
- https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://github.com/FasterXML/jackson-modules-java8
Sources
- CVE-2018-1000873 · CVE Program
- CVE-2018-1000873 · NVD
- FIRST EPSS
- GHSA-h4x4-5qp2-wp46 · GitHub Advisory Database · CC BY 4.0
- CVE-2018-1000873 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences