CVE-2018-14721 in the critical feed json
Server-Side Request Forgery (SSRF) in jackson-databind
published 7y ago modified 25d ago also GHSA-9mxf-g3x6-wv74 , EUVD-2019-0181
- cvss
- 10.0
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 10.5%
- EPSS 10.5% chance of exploitation in 30 days, percentile 95%
- public exploits
- 0
- none known
Summary
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
Patch / fix
- maven com.fasterxml.jackson.core:jackson-databind 2.7.9.5, 2.8.11.3, 2.9.7
- fasterxml jackson-databind 2.6.7.2, 2.7.9.5, 2.8.11.3, 2.9.7
- jackson-databind Debian 14, Debian 13, Debian 12 2.9.8-1
debian advisories DEBIAN-CVE-2018-14721
- jackson-databind Ubuntu Pro 16.04 LTS 2.4.2-3ubuntu0.1~esm2
ubuntu advisories UBUNTU-CVE-2018-14721
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- eap7-dom4j jboss enterprise application platform 7.2 2.1.1-2.redhat_00001.1.el7eap
- eap7-jberet jboss enterprise application platform 7.2 1.3.2-1.Final_redhat_00001.1.el7eap
- eap7-yasson jboss enterprise application platform 7.2 1.0.2-1.redhat_00001.1.el7eap
- eap7-wildfly jboss enterprise application platform 7.2 7.2.1-6.GA_redhat_00004.1.el7eap
- eap7-narayana jboss enterprise application platform 7.2 5.9.1-1.Final_redhat_00001.1.el7eap
- eap7-resteasy jboss enterprise application platform 7.2 3.6.1-4.SP3_redhat_00001.1.el7eap
- eap7-undertow jboss enterprise application platform 7.2 2.0.19-1.Final_redhat_00001.1.el7eap
- eap7-hibernate jboss enterprise application platform 7.2 5.3.9-2.Final_redhat_00002.1.el7eap
red hat advisories RHSA-2019:1108RHSA-2019:1107RHSA-2019:0782
- github.com/FasterXML/jackson-databind@87d29af commit
- github.com/FasterXML/jackson-databind/issues/2097 advisory
- oracle.com/technetwork/security-advisory/cpujan2019-5072801.html advisory
- github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7 advisory
- oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html advisory
- oracle.com/technetwork/security-advisory/cpujul2019-5072835.html advisory
Is CVE-2018-14721 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2018-14721 updated cvss 6.8
jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class
-
Red Hat BPM Suite 6 jackson-databindaffected: no fix planned “Will not fix”
-
Red Hat JBoss A-MQ 6 jackson-databindaffected: no fix planned “Out of support scope”
-
Red Hat JBoss BRMS 6 jackson-databind Red Hat JBoss Data Virtualization 6 jackson-databind Red Hat JBoss Fuse 6 jackson-databind Red Hat JBoss Fuse Integration Service 2 jackson-databind Red Hat OpenShift Application Runtimes jackson-databindaffected: no fix planned “Will not fix”
-
Red Hat OpenShift Container Platform 3.6 openshift-elasticsearch-plugin Red Hat OpenShift Container Platform 3.7 openshift-elasticsearch-plugin Red Hat OpenShift Container Platform 3.9 elasticsearch-cloud-kubernetes, openshift-elasticsearch-plugin Red Hat OpenShift Container Platform 3.10 elasticsearch-cloud-kubernetes, openshift-elasticsearch-pluginaffected: no fix available
-
Red Hat OpenShift Logging 5.0 openshift-logging/elasticsearch6-rhel8 v5.0.3-1fixed: vendor fix RHSA-2021:1515
-
Red Hat Data Gridfixed: vendor fix RHSA-2019:4037
-
Red Hat Fuse 7.5.0fixed: vendor fix RHSA-2019:3892
-
Red Hat JBoss BPMS 7.4fixed: vendor fix RHSA-2019:1823
show 11 moreshow fewer
-
Red Hat JBoss BRMS 7.4fixed: vendor fix RHSA-2019:1822
-
Red Hat JBoss EAP 7.2fixed: vendor fix RHSA-2019:1106
-
Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-dom4j 2.1.1-2.redhat_00001.1.el6eap, eap7-yasson 1.0.2-1.redhat_00001.1.el6eap, eap7-apache-cxf 3.2.7-1.redhat_00001.1.el6eap, eap7-byte-buddy 1.9.5-1.redhat_00001.1.el6eap, eap7-cxf-xjc-dv 3.2.3-2.redhat_00002.1.el6eap, eap7-cxf-xjc-ts 3.2.3-2.redhat_00002.1.el6eap, +152 morefixed: vendor fix RHSA-2019:1107
-
Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-dom4j 2.1.1-2.redhat_00001.1.el7eap, eap7-yasson 1.0.2-1.redhat_00001.1.el7eap, eap7-apache-cxf 3.2.7-1.redhat_00001.1.el7eap, eap7-byte-buddy 1.9.5-1.redhat_00001.1.el7eap, eap7-cxf-xjc-dv 3.2.3-2.redhat_00002.1.el7eap, eap7-cxf-xjc-ts 3.2.3-2.redhat_00002.1.el7eap, +154 morefixed: vendor fix RHSA-2019:1108
-
Red Hat JBoss Enterprise Application Platform Continuous Deliveryfixed: vendor fix RHSA-2020:2564
-
Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5 v3.11.153-2fixed: vendor fix RHSA-2019:3149
-
Red Hat OpenShift Container Platform 4.1 openshift4/ose-logging-elasticsearch5 v4.1.18-201909201915fixed: vendor fix RHSA-2019:2858
-
Red Hat OpenShift Container Platform 4.6 openshift4/ose-logging-elasticsearch6 v4.6.0-202104161407.p0fixed: vendor fix RHSA-2021:1230
-
Red Hat Single Sign-On 7.3.1 zipfixed: vendor fix RHSA-2019:1140
-
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-maven35-jackson-databind 2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc 2.7.6-2.5.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-maven35-jackson-databind 2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc 2.7.6-2.5.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-maven35-jackson-databind 2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc 2.7.6-2.5.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-maven35-jackson-databind 2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc 2.7.6-2.5.el7 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-maven35-jackson-databind 2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc 2.7.6-2.5.el7fixed: vendor fix RHSA-2019:0782
-
Red Hat OpenShift Logging 5.0 openshift-logging/fluentd-rhel8 v5.0.3-1, openshift-logging/kibana6-rhel8 v5.0.3-1, openshift-logging/eventrouter-rhel8 v5.0.3-1, openshift-logging/logging-curator5-rhel8 v5.0.3-1, openshift-logging/elasticsearch-proxy-rhel8 v5.0.3-1, openshift-logging/elasticsearch-rhel8-operator v5.0.3-2, +3 more Red Hat Enterprise Linux 8 jackson-databind, jackson-databind-javadoc Red Hat JBoss Enterprise Application Platform 6 jackson-databind Red Hat JBoss Operations Network 3 Core Server Core Server Red Hat Mobile Application Platform 4 jackson-databind Red Hat OpenShift Container Platform 3.11 jackson-databindnot affected: vulnerable code not present
+5 more productsfewer
Red Hat OpenShift Container Platform 4.6 openshift4/ose-ptp v4.6.0-202104151245.p0, openshift4/ose-sriov-cni v4.6.0-202104151245.p0, openshift4/ose-ghostunnel v4.6.0-202104151245.p0, openshift4/ose-descheduler v4.6.0-202104151245.p0, openshift4/ose-ptp-operator v4.6.0-202104151245.p0, openshift4/ose-egress-router v4.6.0-202104151245.p0, +40 more Red Hat OpenStack Platform 8 (Liberty) opendaylight Red Hat OpenStack Platform 9 (Mitaka) opendaylight Red Hat OpenStack Platform 10 (Newton) opendaylight Red Hat OpenStack Platform 13 (Queens) opendaylight
4 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 25d ago
Exploit prediction
10.46% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 10.0 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 10.0 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.fasterxml.jackson.core:jackson-databind | >=2.9.0, <2.9.7 >=2.8.0, <2.8.11.3 >=2.7.0, <2.7.9.5 |
2.9.7 2.8.11.3 2.7.9.5 |
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44
web, patch, third-party-advisory
-
github.com
/FasterXML/jackson-databind/issues/2097
web, issue-tracking, patch, third-party-advisory
-
oracle.com
/technetwork/security-advisory/cpujan2019-5072801.html
web, patch, third-party-advisory
-
github.com
/FasterXML/jackson/wiki/Jackson-Release-2.9.7
web, patch, release-notes, third-party-advisory
-
oracle.com
/technetwork/security-advisory/cpuapr2019-5072813.html
web, patch, third-party-advisory
-
oracle.com
/technetwork/security-advisory/cpujul2019-5072835.html
web, patch, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:0782
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHBA-2019:0959
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:1107
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:1108
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:1106
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:1140
vendor-advisory, web, third-party-advisory
-
debian.org
/security/2019/dsa-4452
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:1822
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:1823
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:2858
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2019:3149
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2019:3892
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2019:4037
vendor-advisory, web
-
lists.debian.org
/debian-lts-announce/2019/03/msg00005.html
mailing-list, web, third-party-advisory
-
lists.apache.org
/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
mailing-list
-
seclists.org
/bugtraq/2019/May/68
mailing-list, web, third-party-advisory
-
security.netapp.com
/advisory/ntap-20190530-0003/
third-party-advisory
-
oracle.com
/technetwork/security-advisory/cpuoct2019-5072832.html
web
-
lists.apache.org
/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
mailing-list
-
oracle.com
/security-alerts/cpuapr2020.html
web
-
lists.apache.org
/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2018-14721
advisory
-
lists.apache.org
/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
web
-
lists.apache.org
/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
web
-
lists.apache.org
/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
web
-
lists.apache.org
/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E
web
-
lists.apache.org
/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E
web
-
security.netapp.com
/advisory/ntap-20190530-0003
web
-
github.com
/advisories/GHSA-9mxf-g3x6-wv74
advisory
Sources
- CVE List CVE-2018-14721
- GitHub Advisory GHSA-9mxf-g3x6-wv74
- NVD CVE-2018-14721
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.