Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM0C49DC7FF9688CB3C8974272755591BF1B851989940E674D2850C0DB0FAA67A4
HistoryMar 01, 2019 - 12:05 a.m.

Security Bulletin: Multiple vulnerabilities affect IBM Cloud Object Storage SDK Java (Feb 2019, updated)

2019-03-0100:05:02
www.ibm.com
15

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

JSON

Summary

Multiple vulnerabilities affect IBM Cloud Object Storage SDK Java. These vulnerabilities have been addressed in the latest SDK Java releases.

Vulnerability Details

CVE-ID: CVE-2018-19362
Description: An unspecified error with failure to block the jboss-common-core class from polymorphic deserialization in FasterXML jackson-databind has an unknown impact and attack vector.
CVSS Base Score: 5.3
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/155093&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVE-ID: CVE-2018-19361
Description: An unspecified error with failure to block the openjpa class from polymorphic deserialization in FasterXML jackson-databind has an unknown impact and attack vector.
CVSS Base Score: 5.3
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/155092&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVE-ID: CVE-2018-19360
Description: An unspecified error with failure to block the axis2-transport-jms class from polymorphic deserialization in FasterXML jackson-databind has an unknown impact and attack vector.
CVSS Base Score: 5.3
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/155091&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVE-ID: CVE-2018-1000873
Description: FasterXML jackson-databind is vulnerable to a denial of service, caused by improper input validation by the nanoseconds time value field. By persuading a victim to deserialize specially-crafted input, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 5.3
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/154804&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

CVE-ID Affected SDK Releases
CVE-2018-19362 IBM COS SDK Java releases prior to 2.4.2
CVE-2018-19361 IBM COS SDK Java releases prior to 2.4.2
CVE-2018-19360 IBM COS SDK Java releases prior to 2.4.2
CVE-2018-1000873 IBM COS SDK Java releases prior to 2.4.2

Remediation/Fixes

IBM COS SDK Releases Link to Fix / Fix Availability Target
SDK Java 2.4.2

https://github.com/IBM/ibm-cos-sdk-java/tree/2.4.2

CPENameOperatorVersion
ibm cloud object storage systemeq2.4.2

Related

ibm 27
nessus 9
fedora 18
openvas 21
redhat 17
osv 12
prion 5
symantec 1
debiancve 3
redhatcve 5
github 5
veracode 4
ubuntucve 4
cve 5
debian 2
ubuntu 1
hp 1
oracle 6
ibm
ibm
Security Bulletin: Multiple vulnerabilities have been identified in FasterXML Jackson library shipped with IBM Tivoli Netcool/OMNIbus Common Integration Libraries (CVE-2018-19360, CVE-2018-19361, CVE-2018-19362, CVE-2018-1000873)
2019-03-05 09:30:01
Security Bulletin: IBM Event Streams is affected by jackson-databind vulnerabilities
2019-04-26 16:00:01
Security Bulletin: Third party vulnerable library Jackson-Databind affects IBM Engineering Lifecycle Optimization - Publishing
2020-07-07 17:41:59
nessus
nessus
Oracle Primavera Gateway Multiple Vulnerabilities (Jul 2019 CPU)
2019-07-19 00:00:00
Fedora 29 : bouncycastle / eclipse-jgit / eclipse-linuxtools / etc (2019-df57551f6d)
2019-02-19 00:00:00
Oracle Primavera Unifier Multiple Vulnerabilities (Apr 2019 CPU)
2019-04-19 00:00:00
fedora
fedora
[SECURITY] Fedora 29 Update: jackson-parent-2.9.1.2-1.fc29
2019-02-19 14:03:53
[SECURITY] Fedora 29 Update: jackson-dataformats-text-2.9.8-1.fc29
2019-02-19 14:03:52
[SECURITY] Fedora 29 Update: jackson-core-2.9.8-1.fc29
2019-02-19 14:03:52
openvas
openvas
Fedora Update for jackson-dataformats-binary FEDORA-2019-df57551f6d
2019-05-07 00:00:00
Fedora Update for jackson-dataformat-xml FEDORA-2019-df57551f6d
2019-05-07 00:00:00
Fedora Update for jackson-module-jsonSchema FEDORA-2019-df57551f6d
2019-05-07 00:00:00
redhat
redhat
(RHSA-2020:2564) Important: EAP Continuous Delivery Technical Preview Release 16 security update
2020-06-15 16:12:30
(RHSA-2019:3002) Important: Red Hat FIS 2.0 on Fuse 6.3.0 R13 security and bug fix update
2019-10-10 12:48:05
(RHSA-2019:1797) Important: Red Hat JBoss BPM Suite 6.4.12 security update
2019-07-16 16:19:53
osv
osv
Moderate severity vulnerability that affects com.fasterxml.jackson.datatype:jackson-datatype-jsr353
2018-12-21 17:46:54
Deserialization of Untrusted Data in jackson-databind
2019-01-04 19:07:01
jackson-databind - security update
2019-03-04 00:00:00
prion
prion
Input validation
2018-12-20 17:29:00
Deserialization of untrusted data
2019-01-02 18:29:00
Deserialization of untrusted data
2019-01-02 18:29:00
symantec
symantec
FasterXML Jackson-databind Deserialization Multiple Remote Code Execution Vulnerabilities
2019-01-02 00:00:00
debiancve
debiancve
CVE-2018-19361
2019-01-02 18:29:00
CVE-2018-19362
2019-01-02 18:29:00
CVE-2018-19360
2019-01-02 18:29:00
redhatcve
redhatcve
CVE-2018-19362
2020-04-09 12:07:42
CVE-2018-19360
2020-04-09 07:12:14
CVE-2018-1000873
2020-02-24 07:31:50
github
github
com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data
2019-01-04 19:07:03
Deserialization of Untrusted Data in jackson-databind due to polymorphic deserialization
2019-01-04 19:06:57
Moderate severity vulnerability that affects com.fasterxml.jackson.datatype:jackson-datatype-jsr353
2018-12-21 17:46:54
veracode
veracode
Denial Of Service (DoS)
2018-10-26 06:49:46
Remote Code Execution (RCE)
2019-01-03 06:15:06
Remote Code Execution (RCE)
2019-01-03 03:06:26
ubuntucve
ubuntucve
CVE-2018-1000873
2018-12-20 00:00:00
CVE-2018-19362
2019-01-02 00:00:00
CVE-2018-19361
2019-01-02 00:00:00
cve
cve
CVE-2018-1000873
2018-12-20 17:29:00
CVE-2018-19360
2019-01-02 18:29:00
CVE-2018-19361
2019-01-02 18:29:00
debian
debian
[SECURITY] [DLA 1703-1] jackson-databind security update
2019-03-04 12:13:19
[SECURITY] [DSA 4452-1] jackson-databind security update
2019-05-24 21:04:55
ubuntu
ubuntu
Jackson Databind vulnerabilities
2021-03-15 00:00:00
hp
hp
HP Device Manager Security Updates
2023-10-20 00:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - October 2019
2020-01-22 00:00:00
Oracle Critical Patch Update Advisory - July 2019
2019-07-16 00:00:00
Oracle Critical Patch Update Advisory - April 2019
2019-04-16 00:00:00

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

JSON
Related for 0C49DC7FF9688CB3C8974272755591BF1B851989940E674D2850C0DB0FAA67A4
ibm27nessus9fedora18openvas21redhat17osv12prion5symantec1debiancve3redhatcve5github5veracode4ubuntucve4cve5debian2ubuntu1hp1oracle6