CVE-2018-12023: Debian Linux

High severity, CVSS 7.5. EPSS: 8.9% chance of exploitation in the next 30 days.

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.

Affected products

• Debian Debian Linux: version 9.0 only
• Fasterxml Jackson-Databind: from 2.7.0, before 2.7.9.4 (fixed in 2.7.9.4); from 2.8.0, before 2.8.11.2 (fixed in 2.8.11.2); from 2.9.0, before 2.9.6 (fixed in 2.9.6)
• Fedoraproject Fedora: version 29 only
• Oracle Jd Edwards Enterpriseone Tools: version 9.2 only
• Oracle Retail Merchandising System: version 15.0 only
• Red Hat Automation Manager: version 7.3.1 only
• Red Hat Decision Manager: version 7.3.1 only
• Red Hat JBoss Brms: version 6.4.10 only
• Red Hat JBoss Enterprise Application Platform: version 7.2.0 only
• Red Hat Openshift Container Platform: version 3.11 only
• Red Hat Single Sign-On: version 7.3 only

Published 2019-03-21. Last modified 2026-06-17.