Jackson Databind Remote Code Execution Vulnerability (4280008)

Return

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title

Jackson Databind Remote Code Execution Vulnerability
Description

Jackson Databind Remote Code Execution vulnerability.
(CVE-2018-7489). This vulnerability allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw.
Cause

This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper. o Remediation - Upgrade to versions 2.9.5 or 2.8.11.1or 2.7.9.3.
Resolution

1. Stop Central Agent.
2. Navigate to %STAT_HOME%\\app\modules\system\layers\base\com\fasterxml\jackson\core\jackson-databind\main
3. Copy there attached jackson-databind-2.7.9.4.jar.
4. Remove jackson-databind-2.4.1.jar
5. Open in text editor module.xml and replace jackson-databind-2.4.1.jar with jackson-databind-2.7.9.4.jar
6. Restart Central Agent
An enhancement request was created for this issue:
STAT-3944
This fix is targeted for Stat 6.2 release.
Defect ID

STAT-3944
Attachments

jackson-databind-2.7.9.4

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title