CVE-2018-1000873

🗓️ 20 Dec 2018 17:00:00Reported by mitreType

Fasterxml Jackson v Before 2.9.8 CWE-20: Improper Input Validation allows DoS. Exploitable via deserializing malicious input with large nanoseconds field in time value. Fixed in 2.9.8

Reporter	Title	Published	Views	Family All 78
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Cloud Object Storage SDK Java (Feb 2019, updated)	1 Mar 201900:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium Insights is affected by Components with known vulnerabilities	6 Oct 202112:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	13 Aug 202122:15	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Planning Analytics	25 Jul 201918:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE)	12 Jan 202114:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is affected by jackson-databind vulnerabilities	26 Apr 201916:00	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Fasterxml Jackson,FasterXML Jackson Core,Bouncy Castle Java, Netty,Hibernate Validator,JCraft JSch,Apache Tomcat,Bootstrap might affect IBM Storage Defender Copy Data Management	12 Dec 202515:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM B2B Advanced Communications is vulnerable to denial of service due to FasterXML jackson-databind (CVE-2018-1000873)	20 Feb 202307:23	–	ibm
IBM Security Bulletins	Security Bulletin: Third party vulnerable library Jackson-Databind affects IBM Engineering Lifecycle Optimization - Publishing	7 Jul 202017:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Jackson-Databind Affect IBM Global High Availability Mailbox	24 May 201915:35	–	ibm

NVD

Node

fasterxml jackson-modules-java8Range<2.9.8

Node

oracle clusterwareMatch12.1.0.2.0

oracle database_serverMatch12.1.0.2

oracle database_serverMatch12.2.0.1

oracle database_serverMatch18c

oracle database_serverMatch19c

oracle global_lifecycle_management_opatchRange<11.2.0.3.23

oracle global_lifecycle_management_opatchRange12.2.0.1.0–12.2.0.1.19

oracle global_lifecycle_management_opatchRange13.9.4.0.0–13.9.4.2.1

oracle nosql_databaseRange<19.3.12

Node

netapp active_iq_unified_managerRange7.3≥linux

netapp active_iq_unified_managerRange7.3≥windows

netapp active_iq_unified_managerRange9.5≥vmware_vsphere

Source	Link
lists	www.lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
oracle	www.oracle.com/security-alerts/cpuapr2020.html
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/FasterXML/jackson-modules-java8/pull/87
github	www.github.com/FasterXML/jackson-modules-java8/issues/90
lists	www.lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E
oracle	www.oracle.com/security-alerts/cpuoct2020.html
oracle	www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
security	www.security.netapp.com/advisory/ntap-20200904-0004/
lists	www.lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E

21 Nov 2024 03:40Current

7.7High risk

Vulners AI Score7.7

CVSS 24.3

CVSS 3.16.5

EPSS0.02189

CWE-20