Back

CRITICAL

jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class

Published Jan 2, 2019

Description

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.

Affected products

Remediation

Red Hat statement

Red Hat Satellite 6 is not affected by this issue, since its candlepin component doesn't bundle axis2-jaxws jar. Red Hat Virtualization is not affected by this issue, since its does not bundle axis2-jaxws jar.

Metrics

References (39)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jan 2, 2019
Updated Aug 5, 2024
Reserved Jul 28, 2018
NVD
Status Modified
Modified Jun 17, 2026
Red Hat
Severity Moderate
Public date Jul 27, 2018
GHSA-9MXF-G3X6-WV74