Back

CRITICAL

jackson-databind: arbitrary code execution in slf4j-ext class

Published Jan 2, 2019

Description

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.

Affected products

Remediation

Red Hat statement

This vulnerability in jackson-databind involves exploiting CVE-2018-1088 against slf4j, which was fixed in Red Hat products through the errata referenced at https://access.redhat.com/security/cve/cve-2018-8088. Applications that link only slf4j versions including that fix are not vulnerable to this vulnerability. Red Hat Satellite 6 is not affected by this issue, since its candlepin component doesn't bundle slf4j-ext jar.

Metrics

References (47)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jan 2, 2019
Updated Aug 5, 2024
Reserved Jul 28, 2018
NVD
Status Modified
Modified Jun 17, 2026
Red Hat
Severity Important
Public date Jul 27, 2018
GHSA-645P-88QH-W398