StackRadar

CVE-2018-14720

Critical

Advisory

Published 4 Jan 2019In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.075
94th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
56
of 17,781 indexed, latest versions
Container images
57
deployed by those charts
Fix available
1 of 1
affected package

XML External Entity Reference (XXE) in jackson-databind

Carried by container images the latest versions of 56 of 17,781 indexed charts deploy, on 57 images.

Affected packageAffected versionsFixed inImages
jackson-databindmaven2.7.3, 2.7.8, 2.7.9, 2.7.9.3+15 more2.7.9.5, 2.8.11.3, 2.9.757
OSV records
GHSA-x2w5-5m2g-7h5m

Charts affected

56 by stars
ChartLatestAffected imagesRadar Score
microcksmicrocksOfficialVerified publisher0.8.0-helm-3.kube-1.171 of 5See more

microcks microcks 0.8.0-helm-3.kube-1.17

1 of the 5 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
microcks/microcks:0.8.0e3a3e0c67b09
jackson-databind@2.8.11.2
2.8.11.3

Open the chart page →

10,732
sparkmicrosoft1.0.42 of 3See more

spark microsoft 1.0.4

2 of the 3 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
dbanda/livy:0.80ca125e68e53
jackson-databind@2.9.5
2.9.7
dbanda/spark:2.4.6d0e6367876ae
jackson-databind@2.7.8
2.7.9.5

Open the chart page →

13,738
hivebigdata-chartsVerified publisher0.1.81 of 1See more

hive bigdata-charts 0.1.8

1 of the 1 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
5200710/hive:3.1.3-postgresql-metastoree34ab066d2ed
jackson-databind@2.9.4
2.9.7

Open the chart page →

7,166
hive-metastoreheva-helm-chartsVerified publisher0.2.01 of 2See more

hive-metastore heva-helm-charts 0.2.0

1 of the 2 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
sslhep/hive-metastore:3.1.39e80af083079
jackson-databind@2.7.8
2.7.9.5

Open the chart page →

7,335
skywalkingkubesphere-testVerified publisher3.1.01 of 4See more

skywalking kubesphere-test 3.1.0

1 of the 4 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
apache/skywalking-oap-server:8.1.0-es7641237e0299b
jackson-databind@2.9.5
2.9.7

Open the chart page →

18,042
hadoopcloudnativeapp1.1.01 of 1See more

hadoop cloudnativeapp 1.1.0

1 of the 1 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
danisla/hadoop:2.9.0255ba2dd739b
jackson-databind@2.7.8
2.7.9.5

Open the chart page →

5,772
ignitecloudnativeapp1.0.01 of 1See more

ignite cloudnativeapp 1.0.0

1 of the 1 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
apacheignite/ignite:2.7.0d7deab68b8fa
jackson-databind@2.9.6
2.9.7

Open the chart page →

7,891
hbasedmwm-bigdataVerified publisher0.1.61 of 5See more

hbase dmwm-bigdata 0.1.6

1 of the 5 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
gradiant/hbase-base:2.0.1a1ee6de94c04
jackson-databind@2.9.2
2.9.7

Open the chart page →

13,392
opentsdbdmwm-bigdataVerified publisher0.1.72 of 6See more

opentsdb dmwm-bigdata 0.1.7

2 of the 6 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
gradiant/hbase-base:2.0.1a1ee6de94c04
jackson-databind@2.9.2
2.9.7
gradiant/opentsdb:2.4.0c33d53913869
jackson-databind@2.9.5
2.9.7

Open the chart page →

17,511
elasticsearch-dataempathyco0.2.01 of 2See more

elasticsearch-data empathyco 0.2.0

1 of the 2 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
empathyco/elasticsearch:6.6.2-memlockbcf4365ee7ec
jackson-databind@2.8.11
2.8.11.3

Open the chart page →

3,703
elasticsearch-masterempathyco0.3.01 of 2See more

elasticsearch-master empathyco 0.3.0

1 of the 2 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
empathyco/elasticsearch:6.6.2-memlockbcf4365ee7ec
jackson-databind@2.8.11
2.8.11.3

Open the chart page →

3,703
hbasegradiant-bigdataVerified publisher0.1.61 of 5See more

hbase gradiant-bigdata 0.1.6

1 of the 5 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
gradiant/hbase-base:2.0.1a1ee6de94c04
jackson-databind@2.9.2
2.9.7

Open the chart page →

13,392
hadoopmiuler1.2.21 of 1See more

hadoop miuler 1.2.2

1 of the 1 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
danisla/hadoop:2.9.0255ba2dd739b
jackson-databind@2.7.8
2.7.9.5

Open the chart page →

5,772
kafka-managerradar-baseVerified publisher2.3.11 of 1See more

kafka-manager radar-base 2.3.1

1 of the 1 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
radarbase/kafka-manager:1.3.3.181d2af7dd5a4e
jackson-databind@2.9.4
2.9.7

Open the chart page →

4,000
seldon-coreseldon0.2.72 of 3See more

seldon-core seldon 0.2.7

2 of the 3 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
seldonio/apife:0.2.7ba81b17f00eb
jackson-databind@2.8.11.2
2.8.11.3
seldonio/cluster-manager:0.2.729e362bb1ba2
jackson-databind@2.8.11.2
2.8.11.3

Open the chart page →

13,798
graylogt3n1.0.01 of 3See more

graylog t3n 1.0.0

1 of the 3 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
graylog2/server:2.4.3-38ff28c66e6c1
jackson-databind@2.8.9
2.8.11.3

Open the chart page →

8,063
tsoragecetic0.4.111 of 8See more

tsorage cetic 0.4.11

1 of the 8 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:5.0.1c87b1c07fb53
jackson-databind@2.9.6
2.9.7

Open the chart page →

12,018
event-store-servicechoerodon0.8.01 of 2See more

event-store-service choerodon 0.8.0

1 of the 2 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
choerodon/event-store-service:0.8.03c94c97f6f69
jackson-databind@2.8.8
2.8.11.3

Open the chart page →

9,808
cassandra-reapercloudnativeapp0.2.01 of 1See more

cassandra-reaper cloudnativeapp 0.2.0

1 of the 1 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
thelastpickle/cassandra-reaper:1.3.09c53996c457d
jackson-databind@2.8.11
2.8.11.3

Open the chart page →

5,078
gocdcloudnativeapp1.9.21 of 2See more

gocd cloudnativeapp 1.9.2

1 of the 2 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
gocd/gocd-server:v19.3.02da45cb09d57
jackson-databind@2.9.4
2.9.7

Open the chart page →

9,144
hazelcastcloudnativeapp1.3.11 of 1See more

hazelcast cloudnativeapp 1.3.1

1 of the 1 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
hazelcast/hazelcast:3.11.2ca7d5589744f
jackson-databind@2.8.7
2.8.11.3

Open the chart page →

4,982
hazelcast-jetcloudnativeapp1.1.01 of 1See more

hazelcast-jet cloudnativeapp 1.1.0

1 of the 1 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
hazelcast/hazelcast-jet:3.0df495e64ea65
jackson-databind@2.8.7
2.8.11.3

Open the chart page →

5,326
prestocloudnativeapp0.1.11 of 1See more

presto cloudnativeapp 0.1.1

1 of the 1 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
bivas/presto:0.19605545994f806
jackson-databind@2.8.1
2.8.11.3

Open the chart page →

7,226
rundeckcloudnativeapp0.1.01 of 2See more

rundeck cloudnativeapp 0.1.0

1 of the 2 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
rundeck/rundeck:3.0.16b13e8059ad72
jackson-databind@2.9.6
2.9.7

Open the chart page →

23,665
pulsarcnieg1.0.81 of 2See more

pulsar cnieg 1.0.8

1 of the 2 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
jackson-databind@2.9.5
2.9.7

Open the chart page →

16,860
my-chartfleet-web-app0.1.02 of 6See more

my-chart fleet-web-app 0.1.0

2 of the 6 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
richardchesterwood/k8s-fleetman-api-gateway:release2518f946b9f05
jackson-databind@2.8.7
2.8.11.3
richardchesterwood/k8s-fleetman-position-tracker:release336c43961214c
jackson-databind@2.8.1
2.8.11.3

Open the chart page →

24,296
mod-marccatfolio-org0.1.301 of 1See more

mod-marccat folio-org 0.1.30

1 of the 1 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
folioci/mod-marccat:latest1b57d690d568
jackson-databind@2.9.4
2.9.7

Open the chart page →

6,988
geonetwork-k8sgeonetwork-k8sVerified publisher4.2.82 of 5See more

geonetwork-k8s geonetwork-k8s 4.2.8

2 of the 5 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
geonetwork/gn-cloud-ogc-api-records-service:4.2.8-020c9bb761f67
jackson-databind@2.9.6
2.9.7
jingking/geonetwork-hnap:4.2.843e74ab234e1
jackson-databind@2.9.6
2.9.7

Open the chart page →

34,754
video-analytics-demogpu-operator0.1.91 of 3See more

video-analytics-demo gpu-operator 0.1.9

1 of the 3 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
anguda/ant-media:2.5c435285fc241
jackson-databind@2.9.6
2.9.7

Open the chart page →

15,722
opentsdbgradiant-bigdataVerified publisher0.1.72 of 6See more

opentsdb gradiant-bigdata 0.1.7

2 of the 6 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
gradiant/hbase-base:2.0.1a1ee6de94c04
jackson-databind@2.9.2
2.9.7
gradiant/opentsdb:2.4.0c33d53913869
jackson-databind@2.9.5
2.9.7

Open the chart page →

17,511
ubooquityhalkeye0.1.11 of 1See more

ubooquity halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
linuxserver/ubooquity:2.1.2-ls369932d6759112
jackson-databind@2.8.4
2.8.11.3

Open the chart page →

4,303
springboothelmcharts1.0.01 of 1See more

springboot helmcharts 1.0.0

1 of the 1 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
kimb88/hello-world-spring-boot:latest0639155241cb
jackson-databind@2.9.6
2.9.7

Open the chart page →

6,451
ibm-business-automation-insights-devibm-charts3.2.02 of 6See more

ibm-business-automation-insights-dev ibm-charts 3.2.0

2 of the 6 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
ibmcom/bai-elasticsearch-dev:19.0.25441dba2fa00
jackson-databind@2.8.11.2
2.8.11.3
ibmcom/bai-flink-dev:19.0.2e31ff09e8aad
jackson-databind@2.7.9
2.7.9.5

Open the chart page →

39,349
ibm-kerify-devibm-charts1.0.01 of 1See more

ibm-kerify-dev ibm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
ibmcom/icp-sert-bats:3.2.0b558f2b444ae
jackson-databind@2.9.6
2.9.7

Open the chart page →

8,221
ibm-microclimateibm-charts0.1.02 of 8See more

ibm-microclimate ibm-charts 0.1.0

2 of the 8 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
ibmcom/microclimate-file-watcher:latestab3fd1fdfa18
jackson-databind@2.8.8
2.8.11.3
ibmcom/microclimate-theia:lateste17bdccc5030
jackson-databind@2.8.8
2.8.11.3

Open the chart page →

57,669
ibm-ws-dyn-agent-devibm-charts1.0.01 of 1See more

ibm-ws-dyn-agent-dev ibm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
ibmcom/ibm-workload-scheduler-agent-dynamic-dev:9.4.0.047e4dc1e27cdf
jackson-databind@2.9.4
2.9.7

Open the chart page →

19,295
tapm-componentkubebb5.7.11 of 3See more

tapm-component kubebb 5.7.1

1 of the 3 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
refar/apm-api:v5.7.1241373fa2972
jackson-databind@2.7.9.4
2.7.9.5

Open the chart page →

10,264
opendistro-eslsst-sqre1.4.11 of 3See more

opendistro-es lsst-sqre 1.4.1

1 of the 3 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch:1.4.06df71eb04639
jackson-databind@2.8.11
2.8.11.3

Open the chart page →

7,929
pulsarv2milvus-helm2.7.81 of 4See more

pulsarv2 milvus-helm 2.7.8

1 of the 4 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
jackson-databind@2.9.5
2.9.7

Open the chart page →

15,855
MINTmint8.0.21 of 15See more

MINT mint 8.0.2

1 of the 15 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
mintproject/model-catalog-endpoint:29256555a6fbaefae4729d5cd259564708a4ab04ffbb13f20465
jackson-databind@2.9.6
2.9.7

Open the chart page →

43,341
polyglotncsaVerified publisher0.1.11 of 18See more

polyglot ncsa 0.1.1

1 of the 18 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
craigwillis/c2metadata-bd:latestae317d7e4724
jackson-databind@2.8.6
2.8.11.3

Open the chart page →

55,726
hive-metastoreolehrgfVerified publisher0.1.01 of 1See more

hive-metastore olehrgf 0.1.0

1 of the 1 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
ghcr.io/melodyyangaws/hive-metastore:3.0.0e949b0f733f0
jackson-databind@2.9.4
2.9.7

Open the chart page →

8,540
cdn-remoteopencord0.2.41 of 3See more

cdn-remote opencord 0.2.4

1 of the 3 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
omecproject/cdn-antmedia:1.0.0b4ae7d0d6b74
jackson-databind@2.9.5
2.9.7

Open the chart page →

63,223
comacopencord1.0.01 of 9See more

comac opencord 1.0.0

1 of the 9 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
omecproject/onos-progran:1.0.05715e5648aa0
jackson-databind@2.7.3
2.7.9.5

Open the chart page →

88,546
mcord-cdn-remoteopencord0.1.61 of 2See more

mcord-cdn-remote opencord 0.1.6

1 of the 2 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
woojoong/wowza:latestec230db19652
jackson-databind@2.9.0
2.9.7

Open the chart page →

42,614
onos-progranopencord1.2.71 of 2See more

onos-progran opencord 1.2.7

1 of the 2 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
muluder/prograncontrollermcord:0.1.843b597a93da7
jackson-databind@2.7.3
2.7.9.5

Open the chart page →

38,865
ves-agentopencord1.0.21 of 1See more

ves-agent opencord 1.0.2

1 of the 1 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
opencord/ves-agent:1.0.04187e2a8c918
jackson-databind@2.9.5
2.9.7

Open the chart page →

6,350
voltha-infraopencord2.14.01 of 10See more

voltha-infra opencord 2.14.0

1 of the 10 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
atomix/atomix:3.1.127738ff4f5c63
jackson-databind@2.9.6
2.9.7

Open the chart page →

41,044
jmxproxypndaproject0.1.01 of 1See more

jmxproxy pndaproject 0.1.0

1 of the 1 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
gradiant/jmxproxy:3.4.045eceb1bc55c
jackson-databind@2.9.4
2.9.7

Open the chart page →

4,177
hive-metastorepresto-loadbalancer0.2.31 of 1See more

hive-metastore presto-loadbalancer 0.2.3

1 of the 1 container images this version deploys carry CVE-2018-14720.

Container imageDigestPackageFixed in
datappeal/hive-metastore:lateste38c085a3567
jackson-databind@2.9.5
2.9.7

Open the chart page →

9,606

Container images carrying it

57 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
rundeck/rundeck:3.0.16b13e8059ad72
jackson-databind@2.9.6
2.9.7
1
seldonio/apife:0.2.7ba81b17f00eb
jackson-databind@2.8.11.2
2.8.11.3
1
seldonio/cluster-manager:0.2.729e362bb1ba2
jackson-databind@2.8.11.2
2.8.11.3
1
sslhep/hive-metastore:3.1.39e80af083079
jackson-databind@2.7.8
2.7.9.5
1
thelastpickle/cassandra-reaper:1.3.09c53996c457d
jackson-databind@2.8.11
2.8.11.3
1
woojoong/wowza:latestec230db19652
jackson-databind@2.9.0
2.9.7
1
ghcr.io/melodyyangaws/hive-metastore:3.0.0e949b0f733f0
jackson-databind@2.9.4
2.9.7
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.