CVE-2018-21234 Deserialization of Untrusted Data in Jodd
Attackers can execute arbitrary code via deserialization of untrusted JSON data in Jodd when specific metadata settings are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-21234?
CVE-2018-21234 is a critical unsafe deserialization vulnerability in n/a, published on 21 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.
Weakness: CWE-502
Which versions are affected by CVE-2018-21234?
2 open source packages ship an affected version, including org.jodd:jodd-json. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.jodd:jodd-json Maven | All versions | 5.0.4 |
org.jodd:jodd-json Maven | All versions | 5.0.4 |
Products include Apache Hive, Jodd Jodd.
How do I fix CVE-2018-21234?
Upgrade org.jodd:jodd-json to 5.0.4 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2018-21234 being exploited?
There is no known exploitation of CVE-2018-21234 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-49845 Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths
- CVE-2026-55976 Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url
- CVE-2018-1282 SQL Injection in hive-jdbc
- CVE-2022-41137 Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore
- CVE-2015-7521 High severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service
Sources
Also known as GHSA-jrg3-qq99-35g7, UBUNTU-CVE-2018-21234.