DEBIAN-CVE-2018-12023

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/DEBIAN-CVE-2018-12023
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2018-12023.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2018-12023
Upstream
Published
2019-03-21T16:00:12Z
Modified
2025-09-19T06:24:47Z
Summary
[none]
Details

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.

References

Affected packages

Debian:11 / jackson-databind

Package

Name
jackson-databind
Purl
pkg:deb/debian/jackson-databind?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9.8-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / jackson-databind

Package

Name
jackson-databind
Purl
pkg:deb/debian/jackson-databind?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9.8-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / jackson-databind

Package

Name
jackson-databind
Purl
pkg:deb/debian/jackson-databind?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9.8-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14 / jackson-databind

Package

Name
jackson-databind
Purl
pkg:deb/debian/jackson-databind?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9.8-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}