(https://nvd.nist.gov/vuln/detail/CVE-2018-14718): FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization. (https://nvd.nist.gov/vuln/detail/CVE-2018-14719): FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization. (https://nvd.nist.gov/vuln/detail/CVE-2018-14720): FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization. (https://nvd.nist.gov/vuln/detail/CVE-2018-14721): FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization. Upstream Fix: https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44 tl;dr CVE-2018-14718: RCE with slf4j-ext jar CVE-2018-14719: RCE with blaze-ds-opt, -core jars CVE-2018-14720: exfiltration/XXE with only JDK classes (some JDK versions) CVE-2018-14721: exfiltration/SSRF with axis2-jaxws Gentoo Security Padawan (domhnall)
Package removed from the Portage tree. https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6599dc1625a0840c6280b60cc6cacf388fc8d049
