CVE-2018-5968 : Security Advisory and Response

CVE-2018-5968 was published on January 22, 2018, and is related to an unauthenticated remote code execution vulnerability in FasterXML jackson-databind. This CVE arises due to an insufficient fix for previously identified deserialization flaws, CVE-2017-7525 and CVE-2017-17485. The vulnerability affects versions before 2.8.11 and 2.9.x until 2.9.3.

Understanding CVE-2018-5968

This section provides insights into the nature and impact of CVE-2018-5968.

What is CVE-2018-5968?

CVE-2018-5968 is an unauthenticated remote code execution vulnerability in FasterXML jackson-databind versions prior to 2.8.11 and 2.9.x until 2.9.3. It allows attackers to execute code remotely due to incomplete fixes for known deserialization flaws.

The Impact of CVE-2018-5968

The vulnerability can be exploited using specific gadgets that bypass the existing blacklist mechanism, potentially leading to unauthorized remote code execution.

Technical Details of CVE-2018-5968

This section delves into the technical aspects of CVE-2018-5968.

Vulnerability Description

FasterXML jackson-databind through versions 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of incomplete fixes for CVE-2017-7525 and CVE-2017-17485 deserialization flaws.

Affected Systems and Versions

Product: Not applicable
Vendor: Not applicable
Versions: All versions before 2.8.11 and 2.9.x until 2.9.3

Exploitation Mechanism

The vulnerability can be exploited using two separate gadgets that successfully bypass the existing blacklist mechanism.

Mitigation and Prevention

Learn how to mitigate and prevent the exploitation of CVE-2018-5968.

Immediate Steps to Take

Update FasterXML jackson-databind to versions 2.8.11 or 2.9.4 and above to patch the vulnerability.
Implement network security measures to restrict unauthorized access.

Long-Term Security Practices

Regularly update software and libraries to address known vulnerabilities.
Conduct security audits and penetration testing to identify and remediate weaknesses.

Patching and Updates

Stay informed about security advisories from relevant vendors.
Apply patches and updates promptly to ensure system security.