CVE:CVE-2018-12022
CNNVD:CNNVD-201902-747
FasterXML Jackson是美国FasterXML公司的一款适用于Java的数据处理工具。jackson-databind是其中的一个具有数据绑定功能的组件。
FasterXML jackson-databind 2.7.9.4之前版本、2.8.11.2之前版本和2.9.6之前版本中存在安全漏洞。远程攻击者可利用该漏洞执行执行代码。
solution:Upgrade fasterxml jackson-databind to a higher version than 2.7.9.4,2.8.11.2,2.9.6,and avoid the version [2.7.0,2.7.9.4),[2.8.0,2.8.11.2),[2.9.0,2.9.6); Upgrade debian debian_linux to a higher version than 9.0,and avoid the version 9.0; Upgrade fedoraproject fedora to a higher version than 29,and avoid the version 29; Upgrade oracle jd_edwards_enterpriseone_tools to a higher version than 9.2,and avoid the version 9.2; Upgrade oracle retail_merchandising_system to a higher version than 15.0,and avoid the version 15.0; Upgrade redhat automation_manager to a higher version than 7.3.1,and avoid the version 7.3.1; Upgrade redhat decision_manager to a higher version than 7.3.1,and avoid the version 7.3.1; Upgrade redhat jboss_brms to a higher version than 6.4.10,and avoid the version 6.4.10; Upgrade redhat jboss_enterprise_application_platform to a higher version than 7.2.0,and avoid the version 7.2.0; Upgrade redhat openshift_container_platform to a higher version than 3.11,and avoid the version 3.11; Upgrade redhat single_sign-on to a higher version than 7.3,and avoid the version 7.3