This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2018-5968 →
DEBIAN-CVE-2018-5968
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CV...
Original description
The description as published by the source.
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
jackson-databind
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-1"}]}]
Debian:13
jackson-databind
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-1"}]}]
Debian:14
jackson-databind
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-1"}]}]
References
- advisory security-tracker.debian.org