CVE-2018-21234

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2018-21234
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-21234.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-21234
Aliases
Downstream
Published
2020-05-21T23:15:11Z
Modified
2025-10-21T04:33:28.765194Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.

References

Affected packages

Git / github.com/oblac/jodd

Affected ranges

Type
GIT
Repo
https://github.com/oblac/jodd
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9bffc3913aeb8472c11bb543243004b4b4376f16

Affected versions

v3.*

v3.4.0
v3.4.1
v3.4.10
v3.4.2
v3.4.3
v3.4.4
v3.4.5
v3.4.7
v3.4.8
v3.4.9
v3.5
v3.5.1
v3.5.2
v3.6
v3.6.1
v3.6.2
v3.6.3
v3.6.4
v3.6.5
v3.6.6
v3.6.7
v3.7
v3.7.1
v3.8
v3.8.0
v3.8.1
v3.8.5
v3.8.6
v3.9
v3.9.1

v4.*

v4.0.0
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.2.0
v4.3.0
v4.3.1
v4.3.2

v5.*

v5.0.0
v5.0.1
v5.0.2
v5.0.3

Database specific

vanir_signatures

[
    {
        "id": "CVE-2018-21234-0a186348",
        "target": {
            "file": "jodd-json/src/main/java/jodd/json/JsonParser.java"
        },
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "198522618421086842669461628958655246747",
                "299400162155763133414993199138688733038",
                "36460051375629793932303636773183949303",
                "73198954444898560646212271078822862548",
                "283292402706264191490652796043599367024",
                "164404745960515918751399929734795685030",
                "5013077261249814823333178636179576197"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "source": "https://github.com/oblac/jodd/commit/9bffc3913aeb8472c11bb543243004b4b4376f16",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2018-21234-80b6864d",
        "target": {
            "function": "map2bean",
            "file": "jodd-json/src/main/java/jodd/json/MapToBean.java"
        },
        "signature_version": "v1",
        "digest": {
            "length": 1556.0,
            "function_hash": "150659002444411691445559585148327620157"
        },
        "deprecated": false,
        "source": "https://github.com/oblac/jodd/commit/9bffc3913aeb8472c11bb543243004b4b4376f16",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2018-21234-839c464f",
        "target": {
            "file": "jodd-json/src/main/java/jodd/json/MapToBean.java"
        },
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "214725461818025221634430265778613246701",
                "244967375890363988297663312649443074228",
                "21965940755875442979336604635808219962",
                "301212955012635425009146496555427443621",
                "297694697509337179882558693984498556210",
                "60388440001902776687545077966616286877",
                "308134723903102058898853773951793039204",
                "264932224051603028143653420982385799696",
                "217416844301540765260759182213894968120",
                "243191484542778746029218417175007760524",
                "87972665837479489297426055128452730008"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "source": "https://github.com/oblac/jodd/commit/9bffc3913aeb8472c11bb543243004b4b4376f16",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2018-21234-b94d1d03",
        "target": {
            "file": "jodd-json/src/test/java/jodd/json/JSONDeserializerTest.java"
        },
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "331404379708205865508339681454607284059",
                "119095956572842698012316124600553959001",
                "1278427587890270671785609993730678418",
                "289107508559760982555679376257379788826",
                "203883686736029240460947877299987777306",
                "29010874320862694110270665673835496034",
                "276042016848699108430829193718110593417"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "source": "https://github.com/oblac/jodd/commit/9bffc3913aeb8472c11bb543243004b4b4376f16",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2018-21234-cfa8dd3b",
        "target": {
            "file": "jodd-json/src/main/java/jodd/json/JsonParserBase.java"
        },
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "309586792075453030448865919498237075886",
                "141117149950635304899992242077618966874",
                "199742548849720648788873078390530735582",
                "70036849247241030278167886348885569640"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "source": "https://github.com/oblac/jodd/commit/9bffc3913aeb8472c11bb543243004b4b4376f16",
        "signature_type": "Line"
    }
]