CVE-2017-15095 jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution
CriticalCVSS 9.8
EPSS 8.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.fasterxml.jackson.core/jackson-databind(Maven) | >= 2.8.0, < 2.8.11 | 2.8.11 |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.10 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.6 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.7 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.8 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.8.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.9 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | >= 2.9.0, < 2.9.4 | 2.9.4 |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.0.pr1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.0.pr2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.0.pr3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.0.pr4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | >= 2.0.0, < 2.6.7.3 | 2.6.7.3 |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.0.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.0.1 | No fix listed |
Show 131 more
| Product | Affected versions | Fixed in |
|---|---|---|
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.0.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.0.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.0.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.0.6 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.1.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.1.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.1.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.1.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.1.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.1.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.2.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.2.0-rc1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.2.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.2.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.2.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.2.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.3.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.3.0-rc1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.3.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.3.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.3.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.3.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.3.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.0-rc1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.0-rc2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.0-rc3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.1.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.1.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.1.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.5.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.6 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.6.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.5.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.5.0-rc1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.5.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.5.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.5.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.5.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.5.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.0-rc1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.0-rc2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.0-rc3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.0-rc4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.6 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.7 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.7.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.7.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | >= 2.7.0, < 2.7.9.2 | 2.7.9.2 |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.1-1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.6 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.7 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.8 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.9 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.9.1 | No fix listed |
| debian/jackson-databind(Debian:12) | < 2.9.1-1 | 2.9.1-1 |
| debian/jackson-databind(Debian:13) | < 2.9.1-1 | 2.9.1-1 |
| debian/jackson-databind(Debian:14) | < 2.9.1-1 | 2.9.1-1 |
| debian/libjackson-json-java(Debian:12) | < 1.9.13-2 | 1.9.13-2 |
| debian/libjackson-json-java(Debian:13) | < 1.9.13-2 | 1.9.13-2 |
| debian/libjackson-json-java(Debian:14) | < 1.9.13-2 | 1.9.13-2 |
| FasterXML jackson-databind | = before 2.8.10 | No fix listed |
| FasterXML jackson-databind | = before 2.9.1 | No fix listed |
| FasterXML jackson-databind | >= 2.0.0, < 2.6.7.2 | 2.6.7.2 |
| FasterXML jackson-databind | >= 2.7.0, < 2.7.9.2 | 2.7.9.2 |
| FasterXML jackson-databind | >= 2.8.0, < 2.8.10 | 2.8.10 |
| FasterXML jackson-databind | = 2.9.0 | No fix listed |
| FasterXML jackson-databind | = 2.9.0-prerelease1 | No fix listed |
| FasterXML jackson-databind | = 2.9.0-prerelease2 | No fix listed |
| FasterXML jackson-databind | = 2.9.0-prerelease3 | No fix listed |
| FasterXML jackson-databind | = 2.9.0-prerelease4 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| redhat openshift container platform | = 3.11 | No fix listed |
| redhat openshift container platform | = 4.1 | No fix listed |
| redhat satellite | = 6.4 | No fix listed |
| redhat satellite capsule | = 6.4 | No fix listed |
| redhat jboss enterprise application platform | = 6.0.0 | No fix listed |
| redhat jboss enterprise application platform | = 6.4.0 | No fix listed |
| redhat jboss enterprise application platform | = 7.1.0 | No fix listed |
| netapp oncommand balance | All versions | No fix listed |
| netapp oncommand performance manager | All versions | No fix listed |
| netapp oncommand shift | All versions | No fix listed |
| netapp snapcenter | All versions | No fix listed |
| oracle banking platform | = 2.5.0 | No fix listed |
| oracle banking platform | = 2.6.0 | No fix listed |
| oracle banking platform | = 2.6.1 | No fix listed |
| oracle banking platform | = 2.6.2 | No fix listed |
| oracle clusterware | = 12.1.0.2.0 | No fix listed |
| oracle communications billing and revenue management | = 7.5 | No fix listed |
| oracle communications billing and revenue management | = 12.0 | No fix listed |
| oracle communications diameter signaling router | < 8.3 | 8.3 |
| oracle communications instant messaging server | = 10.0.1.2.0 | No fix listed |
| oracle database server | = 12.2.0.1 | No fix listed |
| oracle database server | = 18.1 | No fix listed |
| oracle enterprise manager for virtualization | = 13.2.2 | No fix listed |
| oracle enterprise manager for virtualization | = 13.2.3 | No fix listed |
| oracle enterprise manager for virtualization | = 13.3.1 | No fix listed |
| oracle financial services analytical applications infrastructure | = 8.0.2 | No fix listed |
| oracle financial services analytical applications infrastructure | = 8.0.3 | No fix listed |
| oracle financial services analytical applications infrastructure | = 8.0.4 | No fix listed |
| oracle financial services analytical applications infrastructure | = 8.0.5 | No fix listed |
| oracle financial services analytical applications infrastructure | = 8.0.6 | No fix listed |
| oracle financial services analytical applications infrastructure | = 8.0.7 | No fix listed |
| oracle global lifecycle management opatchauto | < 12.2.0.1.14 | 12.2.0.1.14 |
| oracle Identity Manager | = 11.1.2.3.0 | No fix listed |
| oracle Identity Manager | = 12.2.1.3.0 | No fix listed |
| oracle JD Edwards EnterpriseOne Tools | = 9.2 | No fix listed |
| oracle primavera unifier | >= 17.1, <= 17.12 | No fix listed |
| oracle primavera unifier | = 16.1 | No fix listed |
| oracle primavera unifier | = 16.2 | No fix listed |
| oracle primavera unifier | = 18.8 | No fix listed |
| oracle utilities advanced spatial and operational analytics | = 2.7.0.1 | No fix listed |
| oracle webcenter portal | = 12.2.1.3.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking third-party-advisory
- github.com issue-tracking patch third-party-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- RHSA-2017:3189 third-party-advisory vendor-advisory
- lists.apache.org
- [debian-lts-announce] 20200131 [SECURITY] [DLA 2091-1] libjackson-json-java security update mailing-list third-party-advisory
- security.netapp.com third-party-advisory
- web.archive.org
- web.archive.org
- DSA-4037 third-party-advisory vendor-advisory
- www.oracle.com third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- RHSA-2017:3190 third-party-advisory vendor-advisory
- RHSA-2018:0342 third-party-advisory vendor-advisory
- RHSA-2018:0478 third-party-advisory vendor-advisory
- RHSA-2018:0479 third-party-advisory vendor-advisory
- RHSA-2018:0480 third-party-advisory vendor-advisory
- RHSA-2018:0481 third-party-advisory vendor-advisory
- RHSA-2018:0576 third-party-advisory vendor-advisory
- RHSA-2018:0577 third-party-advisory vendor-advisory
- RHSA-2018:1447 third-party-advisory vendor-advisory
- RHSA-2018:1448 third-party-advisory vendor-advisory
- RHSA-2018:1449 third-party-advisory vendor-advisory
- RHSA-2018:1450 third-party-advisory vendor-advisory
- RHSA-2018:1451 third-party-advisory vendor-advisory
- RHSA-2018:2927 third-party-advisory vendor-advisory
- RHSA-2019:2858 third-party-advisory vendor-advisory
- RHSA-2019:3149 third-party-advisory vendor-advisory
- RHSA-2019:3892 third-party-advisory vendor-advisory
- github.com product
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- github.com
- Debian Security Tracker CVE-2017-15095 vendor-advisory
- 103880 third-party-advisory vdb-entry
- 1039769 third-party-advisory vdb-entry
- [lucene-solr-user] 20191219 Re: CVE-2017-7525 fix for Solr 7.7.x mailing-list