CVE: 2018-11307 found in jackson-databind - Version: 2.4.2 [JAVA]

[github-actions[bot]]

Veracode Software Composition Analysis

Attribute	Details
Library	jackson-databind
Description	General data-binding functionality for Jackson: works on core streaming API
Language	JAVA
Vulnerability	Remote Code Execution (RCE)
Vulnerability description	jackson-databind is vulnerable to remote code execution (RCE) attacks. The vulnerability exists due to the availability of an allowed gadget type that could be used to perform remote code execution attacks through deserialization.
CVE	2018-11307
CVSS score	7.5
Vulnerability present in version/s	2.0.0-RC1-2.7.9.3
Found library version/s	2.4.2
Vulnerability fixed in version	2.7.9.4
Library latest version	2.16.1
Fix	Apply fix patch.

Links:

• https://sca.analysiscenter.veracode.com/vulnerability-database/libraries/908?version=2.4.2
• https://sca.analysiscenter.veracode.com/vulnerability-database/vulnerabilities/6292
• Patch: https://github.com/FasterXML/jackson-databind/commit/27b4defc270454dea6842bd9279f17387eceb737

[github-actions[bot]]

Veracode issue link to PR: https://github.com/tsaekao/verademo-java/pull/2

[github-actions[bot]]

Veracode issue link to PR: https://github.com/tsaekao/verademo-java/pull/43