CVE:CVE-2018-12023
CNNVD:CNNVD-201901-723
FasterXML Jackson是美国FasterXML公司的一款适用于Java的数据处理工具。jackson-databind是其中的一个具有数据绑定功能的组件。
FasterXML Jackson-databind 2.7.9.4之前版本、2.8.11.2之前版本和2.9.6之前版本中存在代码问题漏洞。远程攻击者可利用该漏洞在受影响应用程序的上下文中执行任意代码或造成拒绝服务。
solution:Upgrade fasterxml jackson-databind to a higher version than 2.7.9.4,2.8.11.2,2.9.6,and avoid the version [2.7.0,2.7.9.4),[2.8.0,2.8.11.2),[2.9.0,2.9.6); Upgrade debian debian_linux to a higher version than 9.0,and avoid the version 9.0; Upgrade fedoraproject fedora to a higher version than 29,and avoid the version 29; Upgrade oracle jd_edwards_enterpriseone_tools to a higher version than 9.2,and avoid the version 9.2; Upgrade oracle retail_merchandising_system to a higher version than 15.0,and avoid the version 15.0; Upgrade redhat automation_manager to a higher version than 7.3.1,and avoid the version 7.3.1; Upgrade redhat decision_manager to a higher version than 7.3.1,and avoid the version 7.3.1; Upgrade redhat jboss_brms to a higher version than 6.4.10,and avoid the version 6.4.10; Upgrade redhat jboss_enterprise_application_platform to a higher version than 7.2.0,and avoid the version 7.2.0; Upgrade redhat openshift_container_platform to a higher version than 3.11,and avoid the version 3.11; Upgrade redhat single_sign-on to a higher version than 7.3,and avoid the version 7.3