CVE-2018-14719

Q: What is the severity of CVE-2018-14719?

CVE-2018-14719 has a CVSS score of 9.8 (CRITICAL). CVE-2018-14719 is a remote code execution vulnerability in FasterXML jackson-databind versions 2.x before 2.9.7. It allows attackers to execute arbitrary code by exploiting polymorphic deserialization of untrusted data through blaze-ds-opt and blaze-ds-core classes. Any application using vulnerable jackson-databind versions that deserializes untrusted data is affected.

9.8 CRITICAL

Remote Code Execution Deserialization

📋 TL;DR

CVE-2018-14719 is a remote code execution vulnerability in FasterXML jackson-databind versions 2.x before 2.9.7. It allows attackers to execute arbitrary code by exploiting polymorphic deserialization of untrusted data through blaze-ds-opt and blaze-ds-core classes. Any application using vulnerable jackson-databind versions that deserializes untrusted data is affected.

💻 Affected Systems

Products:

FasterXML jackson-databind

Versions: 2.x before 2.9.7

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Applications must be configured to deserialize untrusted data to be exploitable. Many Java applications use jackson-databind for JSON processing.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise with remote code execution as the application user, potentially leading to data theft, ransomware deployment, or lateral movement.

🟠

Likely Case

Remote code execution leading to application compromise, data exfiltration, or service disruption.

🟢

If Mitigated

Limited impact if proper input validation and deserialization controls are implemented, potentially reduced to denial of service.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires the application to deserialize untrusted JSON data. Public proof-of-concept code exists demonstrating the vulnerability.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.9.7 or later

Vendor Advisory: https://github.com/FasterXML/jackson-databind/issues/2097

Restart Required: Yes

Instructions:

1. Identify jackson-databind version in your application. 2. Update dependency to version 2.9.7 or later. 3. Rebuild and redeploy application. 4. Restart affected services.

🔧 Temporary Workarounds

Block dangerous classes

all

Configure jackson-databind to block blaze-ds-opt and blaze-ds-core classes from deserialization.

Add to application configuration: ObjectMapper mapper = new ObjectMapper(); mapper.enableDefaultTyping(); mapper.addMixIn(Object.class, MyMixInForIgnoreType.class);

Disable default typing

all

Disable polymorphic type handling in ObjectMapper configuration.

Configure ObjectMapper without default typing: ObjectMapper mapper = new ObjectMapper();

🧯 If You Can't Patch

Implement strict input validation and sanitization for all JSON input
Use network segmentation to isolate vulnerable applications and implement strict firewall rules

🔍 How to Verify

Check if Vulnerable:

Check pom.xml, build.gradle, or manifest files for jackson-databind version. Use: mvn dependency:tree | grep jackson-databind or gradle dependencies | grep jackson-databind

Check Version:

mvn dependency:tree | grep jackson-databind

Verify Fix Applied:

Verify updated version in dependency files and confirm application uses jackson-databind 2.9.7+

📡 Detection & Monitoring

Log Indicators:

Unusual Java class loading errors, unexpected deserialization attempts, stack traces containing blaze-ds-opt or blaze-ds-core

Network Indicators:

Unusual outbound connections from application servers, unexpected JSON payloads to deserialization endpoints

SIEM Query:

source="application.logs" AND ("blaze-ds-opt" OR "blaze-ds-core" OR "ClassNotFoundException" OR "InvalidTypeIdException")

📊 Metadata

CVE ID: CVE-2018-14719

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-502

Published: January 2, 2019

Last Updated: November 21, 2024

🔗 References

https://access.redhat.com/errata/RHBA-2019:0959 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0782 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0877 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1782 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1797 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1822 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1823 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2804 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2858 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3002 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3140 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3149 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3892 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4037 Third Party Advisory
https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44 Patch,Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2097 Patch,Third Party Advisory
https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7 Patch,Release Notes,Third Party Advisory
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html Mailing List,Third Party Advisory
https://seclists.org/bugtraq/2019/May/68 Issue Tracking,Mailing List,Third Party Advisory
https://security.netapp.com/advisory/ntap-20190530-0003/ Third Party Advisory
https://www.debian.org/security/2019/dsa-4452 Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch,Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch,Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch,Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html Patch,Third Party Advisory
https://access.redhat.com/errata/RHBA-2019:0959 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0782 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0877 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1782 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1797 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1822 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1823 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2804 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2858 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3002 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3140 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3149 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3892 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4037 Third Party Advisory
https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44 Patch,Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2097 Patch,Third Party Advisory
https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7 Patch,Release Notes,Third Party Advisory
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html Mailing List,Third Party Advisory
https://seclists.org/bugtraq/2019/May/68 Issue Tracking,Mailing List,Third Party Advisory
https://security.netapp.com/advisory/ntap-20190530-0003/ Third Party Advisory
https://www.debian.org/security/2019/dsa-4452 Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch,Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch,Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch,Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html Patch,Third Party Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Business Process Management Suite by Oracle

Business Process Management Suite by Oracle

Clusterware by Oracle

Communications Billing And Revenue Management by Oracle

Communications Billing And Revenue Management by Oracle

Database Server by Oracle

Database Server by Oracle

Database Server by Oracle

Database Server by Oracle

Database Server by Oracle

Debian Linux by Debian

Debian Linux by Debian

Enterprise Manager For Virtualization by Oracle

Enterprise Manager For Virtualization by Oracle

Enterprise Manager For Virtualization by Oracle

Financial Services Analytical Applications Infrastructure by Oracle

Financial Services Analytical Applications Infrastructure by Oracle

Financial Services Analytical Applications Infrastructure by Oracle

Financial Services Analytical Applications Infrastructure by Oracle

Financial Services Analytical Applications Infrastructure by Oracle

Financial Services Analytical Applications Infrastructure by Oracle

Global Lifecycle Management Opatch by Oracle

Global Lifecycle Management Opatch by Oracle

Global Lifecycle Management Opatch by Oracle

Jackson Databind by Fasterxml

Jackson Databind by Fasterxml

Jackson Databind by Fasterxml

Jackson Databind by Fasterxml

Jdeveloper by Oracle

Jdeveloper by Oracle

Oncommand Workflow Automation by Netapp

Openshift Container Platform by Redhat

Openshift Container Platform by Redhat

Openshift Container Platform by Redhat

Primavera P6 Enterprise Project Portfolio Management by Oracle

Primavera P6 Enterprise Project Portfolio Management by Oracle

Primavera P6 Enterprise Project Portfolio Management by Oracle

Primavera P6 Enterprise Project Portfolio Management by Oracle

Primavera P6 Enterprise Project Portfolio Management by Oracle

Primavera P6 Enterprise Project Portfolio Management by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Retail Merchandising System by Oracle

Retail Merchandising System by Oracle

Retail Workforce Management Software by Oracle

Snapcenter by Netapp

Steelstore Cloud Integrated Storage by Netapp

Webcenter Portal by Oracle

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Block dangerous classes

Disable default typing

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export