CVE-2018-19360

A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using the axis2-transport-jms class. An attacker could use this flaw to execute arbitrary code.

Red Hat Satellite 6 is not affected by this issue, since its candlepin component doesn't include axis2-transport-jms jar.

Red Hat Virtualization 4 is not affected by this issue, since it does not include axis2-transport-jms jar.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.