CVE-2018-5968: jackson-databind from 2.0.0 (inclusive), before 2.6.7.3 (exclusive), from 2.7.0 (inclusive), before 2.7.9.2…

Affected technology

jackson-databind · from 2.0.0 (inclusive), before 2.6.7.3 (exclusive)
fasterxml

jackson-databind · from 2.7.0 (inclusive), before 2.7.9.2 (exclusive)
fasterxml

jackson-databind · from 2.8.0 (inclusive), before 2.8.11.1 (exclusive)
fasterxml

jackson-databind · from 2.9.0 (inclusive), before 2.9.4 (exclusive)
fasterxml

debian linux · 8.0
debian

debian linux · 9.0
debian

openshift container platform · 4.1
redhat

virtualization · 4.0
redhat

virtualization host · 4.0
redhat

jboss enterprise application platform · 7.1
redhat

openshift container platform · 3.11
redhat

e-series santricity os controller · from 11.0.0 (inclusive), through 11.60.3 (inclusive)
netapp

e-series santricity web services proxy · Version not applicable in the source CPE
netapp

oncommand shift · Version not applicable in the source CPE
netapp

n/a · n/a
Vendor not specified by the source

Description’s affected range: through 2.8.11 and 2.9.x through 2.9.3

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could run code remotely. NVD’s CVSS 3.1 assessment (base score 8.1/10) rates confidentiality, integrity and availability impact as high.