CVE-2018-21234

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2018-21234
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-21234.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2018-21234
Aliases
Downstream
Published
2020-05-21T23:15:11Z
Modified
2025-09-19T09:45:34.796287Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.

References

Affected packages

Git / github.com/oblac/jodd

Affected ranges

Type
GIT
Repo
https://github.com/oblac/jodd
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9bffc3913aeb8472c11bb543243004b4b4376f16

Affected versions

v3.*

v3.4.0
v3.4.1
v3.4.10
v3.4.2
v3.4.3
v3.4.4
v3.4.5
v3.4.7
v3.4.8
v3.4.9
v3.5
v3.5.1
v3.5.2
v3.6
v3.6.1
v3.6.2
v3.6.3
v3.6.4
v3.6.5
v3.6.6
v3.6.7
v3.7
v3.7.1
v3.8
v3.8.0
v3.8.1
v3.8.5
v3.8.6
v3.9
v3.9.1

v4.*

v4.0.0
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.2.0
v4.3.0
v4.3.1
v4.3.2

v5.*

v5.0.0
v5.0.1
v5.0.2
v5.0.3

Database specific 

{
    "vanir_signatures": [
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "198522618421086842669461628958655246747",
                    "299400162155763133414993199138688733038",
                    "36460051375629793932303636773183949303",
                    "73198954444898560646212271078822862548",
                    "283292402706264191490652796043599367024",
                    "164404745960515918751399929734795685030",
                    "5013077261249814823333178636179576197"
                ]
            },
            "id": "CVE-2018-21234-0a186348",
            "source": "https://github.com/oblac/jodd/commit/9bffc3913aeb8472c11bb543243004b4b4376f16",
            "signature_type": "Line",
            "signature_version": "v1",
            "target": {
                "file": "jodd-json/src/main/java/jodd/json/JsonParser.java"
            },
            "deprecated": false
        },
        {
            "digest": {
                "function_hash": "150659002444411691445559585148327620157",
                "length": 1556.0
            },
            "id": "CVE-2018-21234-80b6864d",
            "source": "https://github.com/oblac/jodd/commit/9bffc3913aeb8472c11bb543243004b4b4376f16",
            "signature_type": "Function",
            "signature_version": "v1",
            "target": {
                "file": "jodd-json/src/main/java/jodd/json/MapToBean.java",
                "function": "map2bean"
            },
            "deprecated": false
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "214725461818025221634430265778613246701",
                    "244967375890363988297663312649443074228",
                    "21965940755875442979336604635808219962",
                    "301212955012635425009146496555427443621",
                    "297694697509337179882558693984498556210",
                    "60388440001902776687545077966616286877",
                    "308134723903102058898853773951793039204",
                    "264932224051603028143653420982385799696",
                    "217416844301540765260759182213894968120",
                    "243191484542778746029218417175007760524",
                    "87972665837479489297426055128452730008"
                ]
            },
            "id": "CVE-2018-21234-839c464f",
            "source": "https://github.com/oblac/jodd/commit/9bffc3913aeb8472c11bb543243004b4b4376f16",
            "signature_type": "Line",
            "signature_version": "v1",
            "target": {
                "file": "jodd-json/src/main/java/jodd/json/MapToBean.java"
            },
            "deprecated": false
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "331404379708205865508339681454607284059",
                    "119095956572842698012316124600553959001",
                    "1278427587890270671785609993730678418",
                    "289107508559760982555679376257379788826",
                    "203883686736029240460947877299987777306",
                    "29010874320862694110270665673835496034",
                    "276042016848699108430829193718110593417"
                ]
            },
            "id": "CVE-2018-21234-b94d1d03",
            "source": "https://github.com/oblac/jodd/commit/9bffc3913aeb8472c11bb543243004b4b4376f16",
            "signature_type": "Line",
            "signature_version": "v1",
            "target": {
                "file": "jodd-json/src/test/java/jodd/json/JSONDeserializerTest.java"
            },
            "deprecated": false
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "309586792075453030448865919498237075886",
                    "141117149950635304899992242077618966874",
                    "199742548849720648788873078390530735582",
                    "70036849247241030278167886348885569640"
                ]
            },
            "id": "CVE-2018-21234-cfa8dd3b",
            "source": "https://github.com/oblac/jodd/commit/9bffc3913aeb8472c11bb543243004b4b4376f16",
            "signature_type": "Line",
            "signature_version": "v1",
            "target": {
                "file": "jodd-json/src/main/java/jodd/json/JsonParserBase.java"
            },
            "deprecated": false
        }
    ]
}