{"id":"CVE-2018-7489","revision":"02f4df4a767e45c380052d27a461b610","records":[{"revision":"02f4df4a767e45c380052d27a461b610","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2018-7489","aliases":[],"title":"FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending mal…","description":"FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.","state":0,"publishedAt":"2018-02-26T15:00:00+00:00","modifiedAt":"2026-10-15T17:43:13.118+00:00","affected":[{"ecosystem":"Vendor product","name":"n/a","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"n/a\",\n                    \"vendor\": \"n/a\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"n/a\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["http://www.securityfocus.com/bid/103203","https://access.redhat.com/errata/RHSA-2018:1448","https://access.redhat.com/errata/RHSA-2018:1449","https://access.redhat.com/errata/RHSA-2018:2938","https://access.redhat.com/errata/RHSA-2018:1450","https://access.redhat.com/errata/RHSA-2018:2090","https://access.redhat.com/errata/RHSA-2018:2939","http://www.securitytracker.com/id/1041890","http://www.securitytracker.com/id/1040693","https://access.redhat.com/errata/RHSA-2018:1786","https://access.redhat.com/errata/RHSA-2018:1451","https://www.debian.org/security/2018/dsa-4190","https://access.redhat.com/errata/RHSA-2018:1447","https://access.redhat.com/errata/RHSA-2018:2088","https://access.redhat.com/errata/RHSA-2018:2089","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3149","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","https://security.netapp.com/advisory/ntap-20180328-0001/","https://github.com/FasterXML/jackson-databind/issues/1931","https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3E"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2018-7489","license":"CVE Program Terms of Use","key":"cve-program:CVE-2018-7489","identifiers":["CVE-2018-7489"]},"retained":false,"historicalAffected":[]}],"coverage":[]}