CVE-2018-14719
jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes
Severity
ImportantRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · July 27, 2018
Updated · August 5, 2026
Description
A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using blaze classes. An attacker could use this flaw to execute arbitrary code.
Statement
The following Red Hat products are not affected by this issue as they do not bundle or provide the requisite gadget jars to exploit this vulnerability: Red Hat Satellite 6 Red Hat Enterprise Virtualization 4 Red Hat Fuse 6, 7, and Fuse Integration Services 2 Red Hat A-MQ 6
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-502 · Deserialization of Untrusted Data