{"id":"CVE-2018-5968","title":"FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws","summary":"FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two diffe…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-184","CWE-502"],"vendor":"fasterxml","product":"jackson-databind","affected":["jackson-databind >= 2.0.0, < 2.6.7.3","jackson-databind >= 2.7.0, < 2.7.9.2","jackson-databind >= 2.8.0, < 2.8.11.1","jackson-databind >= 2.9.0, < 2.9.4","debian_linux = 8.0","debian_linux = 9.0","openshift_container_platform = 4.1","virtualization = 4.0","virtualization_host = 4.0","jboss_enterprise_application_platform = 7.1","openshift_container_platform = 3.11","e-series_santricity_os_controller >= 11.0.0, <= 11.60.3","e-series_santricity_web_services_proxy","oncommand_shift"],"patched":["jackson-databind 2.9.4"],"published":"2018-01-22","updated":"2026-10-08","sourceUpdated":"2026-10-08T22:16:47.083","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2018-5968","references":[{"url":"https://access.redhat.com/errata/RHSA-2018:0478","label":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:0479","label":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:0480","label":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:0481","label":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:1525","label":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:2858","label":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:3149","label":"cve@mitre.org"},{"url":"https://github.com/FasterXML/jackson-databind/issues/1899","label":"cve@mitre.org"},{"url":"https://security.netapp.com/advisory/ntap-20180423-0002/","label":"cve@mitre.org"},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","label":"cve@mitre.org"},{"url":"https://www.debian.org/security/2018/dsa-4114","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","label":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:0478","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0479","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0480","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0481","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:1525","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:2858","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:3149","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/FasterXML/jackson-databind/issues/1899","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20180423-0002/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2018/dsa-4114","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.07213,"epssPercentile":0.94165,"ingestedAt":"2026-10-08T23:16:47.286Z","slug":"CVE-2018-5968","body":"## Overview\n\nFasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.\n\n## Affected\n\n- `jackson-databind >= 2.0.0, < 2.6.7.3`\n- `jackson-databind >= 2.7.0, < 2.7.9.2`\n- `jackson-databind >= 2.8.0, < 2.8.11.1`\n- `jackson-databind >= 2.9.0, < 2.9.4`\n- `debian_linux = 8.0`\n- `debian_linux = 9.0`\n- `openshift_container_platform = 4.1`\n- `virtualization = 4.0`\n- `virtualization_host = 4.0`\n- `jboss_enterprise_application_platform = 7.1`\n- `openshift_container_platform = 3.11`\n- `e-series_santricity_os_controller >= 11.0.0, <= 11.60.3`\n- `e-series_santricity_web_services_proxy`\n- `oncommand_shift`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `jackson-databind 2.9.4`","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":44.6,"likelihood":1.4,"exploitation":0,"ransomware":0},"changes":[]}