CVE-2018-7489: jackson-databind before 2.7.9.3 (exclusive), from 2.8.0 (inclusive), before 2.8.11.1 (exclusive), from 2.9.0…

Affected technology

jackson-databind · before 2.7.9.3 (exclusive)
fasterxml

jackson-databind · from 2.8.0 (inclusive), before 2.8.11.1 (exclusive)
fasterxml

jackson-databind · from 2.9.0 (inclusive), before 2.9.5 (exclusive)
fasterxml

debian linux · 8.0
debian

debian linux · 9.0
debian

communications billing and revenue management · 7.5
oracle

communications billing and revenue management · 12.0
oracle

communications instant messaging server · 10.0.1
oracle

jboss enterprise application platform · 6.4.19
redhat

jboss enterprise application platform · 7.1.2
redhat

n/a · n/a
Vendor not specified by the source

Description’s affected range: before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could run code remotely under the conditions described by the source. NVD’s CVSS 3.0 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high.