CVE-2018-12022

jackson-databind: improper polymorphic deserialization of types from Jodd-db library

Loading…

Severity

Important

Red Hat Product Security

7.3

CVSS 3.0

Review impact separately from score.

Published · May 29, 2018

Updated · August 5, 2026

Description

A vulnerability was discovered in jackson-databind where it would permit deserialization of a malicious object using Jodd DB connection classes when using DefaultTyping. An attacker could use this flaw to achieve remote code execution under certain circumstances.

Statement

Red Hat Satellite 6 is not affected by this issue, since Candlepin's java runtime environment does not load Jodd classes.

Red Hat Virtualization 4 is not affected by this issue, since it does not load Jodd classes.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 7.3
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE-502 · Deserialization of Untrusted Data