CVE:CVE-2018-7489
CNNVD:CNNVD-201802-643
FasterXML jackson-databind是一个基于JAVA可以将XML和JSON等数据格式与JAVA对象进行转换的库。Jackson可以轻松的将Java对象转换成json对象和xml文档，同样也可以将json、xml转换成Java对象。
FasterXML Jackson-databind 2.8.11.1之前版本和2.9.5之前的2.9.x版本中存在代码问题漏洞。远程攻击者可通过向ObjectMapper的readValue方法发送恶意制作的JSON输入利用该漏洞执行代码。
solution:Upgrade fasterxml jackson-databind to a higher version than 2.7.9.3,2.8.11.1,2.9.5,and avoid the version (,2.7.9.3),[2.8.0,2.8.11.1),[2.9.0,2.9.5); Upgrade debian debian_linux to a higher version than 8.0,9.0,and avoid the version 8.0,9.0; Upgrade oracle communications_billing_and_revenue_management to a higher version than 7.5,12.0,and avoid the version 7.5,12.0; Upgrade oracle communications_instant_messaging_server to a higher version than 10.0.1,and avoid the version 10.0.1; Upgrade redhat jboss_enterprise_application_platform to a higher version than 6.4.19,7.1.2,and avoid the version 6.4.19,7.1.2