CVE-2018-11307: jackson-databind from 2.0.0 (inclusive), before 2.6.7.3 (exclusive), from 2.7.0 (inclusive), before 2.7.9.4…

Affected technology

jackson-databind · from 2.0.0 (inclusive), before 2.6.7.3 (exclusive)
fasterxml

jackson-databind · from 2.7.0 (inclusive), before 2.7.9.4 (exclusive)
fasterxml

jackson-databind · from 2.8.0 (inclusive), before 2.8.11.2 (exclusive)
fasterxml

jackson-databind · from 2.9.0 (inclusive), before 2.9.6 (exclusive)
fasterxml

openshift container platform · 3.11
redhat

openshift container platform · 4.1
redhat

clusterware · 12.1.0.2.0
oracle

communications instant messaging server · 10.0.1.2.0
oracle

global lifecycle management opatch · before 11.2.0.3.23 (exclusive)
oracle

global lifecycle management opatch · from 12.2.0.1.0 (inclusive), before 12.2.0.1.19 (exclusive)
oracle

global lifecycle management opatch · from 13.9.4.0.0 (inclusive), before 13.9.4.2.1 (exclusive)
oracle

retail customer management and segmentation foundation · 17.0
oracle

utilities advanced spatial and operational analytics · 2.7.0.1
oracle

n/a · n/a
Vendor not specified by the source

Description’s affected range: through 2.9.5

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

NVD’s CVSS 3.1 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.