CVE-2017-7525 jackson-databind is vulnerable to a deserialization flaw
CriticalCVSS 9.8
EPSS 37.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.fasterxml.jackson.core/jackson-databind(Maven) | < 2.6.7.1 | 2.6.7.1 |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.0.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.0.0-RC1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.0.0-RC2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.0.0-RC3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.0.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.0.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.0.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.0.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.0.6 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.1.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.1.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.1.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.1.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.1.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.1.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.2.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.2.0-rc1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.2.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.2.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.2.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.2.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.3.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.3.0-rc1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.3.1 | No fix listed |
Show 117 more
| Product | Affected versions | Fixed in |
|---|---|---|
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.3.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.3.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.3.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.3.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.0-rc1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.0-rc2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.0-rc3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.1.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.1.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.1.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.5.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.6 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.6.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.5.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.5.0-rc1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.5.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.5.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.5.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.5.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.5.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.0-rc1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.0-rc2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.0-rc3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.0-rc4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.6 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.7 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | >= 2.7.0, < 2.7.9.1 | 2.7.9.1 |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.1-1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.6 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.7 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.8 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.9 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | >= 2.8.0, < 2.8.9 | 2.8.9 |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.6 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.7 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.8 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.8.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | <= 2.6.7.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | >= 2.7.0, <= 2.7.9.0 | No fix listed |
| debian/jackson-databind(Debian:12) | < 2.9.1-1 | 2.9.1-1 |
| debian/jackson-databind(Debian:13) | < 2.9.1-1 | 2.9.1-1 |
| debian/jackson-databind(Debian:14) | < 2.9.1-1 | 2.9.1-1 |
| debian/libjackson-json-java(Debian:12) | < 1.9.13-2 | 1.9.13-2 |
| debian/libjackson-json-java(Debian:13) | < 1.9.13-2 | 1.9.13-2 |
| debian/libjackson-json-java(Debian:14) | < 1.9.13-2 | 1.9.13-2 |
| FasterXML jackson-databind | = before 2.6.7.1 | No fix listed |
| FasterXML jackson-databind | = before 2.7.9.1 | No fix listed |
| FasterXML jackson-databind | = before 2.8.9 | No fix listed |
| FasterXML jackson-databind | < 2.6.7.1 | 2.6.7.1 |
| FasterXML jackson-databind | >= 2.7.0, < 2.7.9.1 | 2.7.9.1 |
| FasterXML jackson-databind | >= 2.8.0, < 2.8.9 | 2.8.9 |
| FasterXML jackson-databind | = 2.9.0-prerelease1 | No fix listed |
| FasterXML jackson-databind | = 2.9.0-prerelease2 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| netapp oncommand balance | All versions | No fix listed |
| netapp oncommand performance manager | All versions | No fix listed |
| netapp oncommand shift | All versions | No fix listed |
| netapp snapcenter | All versions | No fix listed |
| redhat openshift container platform | = 4.1 | No fix listed |
| redhat openshift container platform | = 3.11 | No fix listed |
| redhat virtualization | = 4.0 | No fix listed |
| redhat virtualization host | = 4.0 | No fix listed |
| redhat jboss enterprise application platform | = 6.0.0 | No fix listed |
| redhat jboss enterprise application platform | = 6.4.0 | No fix listed |
| redhat jboss enterprise application platform | = 7.0 | No fix listed |
| redhat jboss enterprise application platform | = 7.1 | No fix listed |
| oracle banking platform | = 2.5.0 | No fix listed |
| oracle banking platform | = 2.6.0 | No fix listed |
| oracle banking platform | = 2.6.1 | No fix listed |
| oracle banking platform | = 2.6.2 | No fix listed |
| oracle communications billing and revenue management | = 7.5 | No fix listed |
| oracle communications billing and revenue management | = 12.0 | No fix listed |
| oracle communications communications policy management | >= 12.0, <= 12.5.2 | No fix listed |
| oracle communications diameter signaling route | < 8.3 | 8.3 |
| oracle communications instant messaging server | = 10.0.1 | No fix listed |
| oracle communications instant messaging server | = 10.0.1.2.0 | No fix listed |
| oracle enterprise manager for virtualization | = 13.2.2 | No fix listed |
| oracle enterprise manager for virtualization | = 13.2.3 | No fix listed |
| oracle enterprise manager for virtualization | = 13.3.1 | No fix listed |
| oracle financial services analytical applications infrastructure | = 8.0.2.0.0 | No fix listed |
| oracle financial services analytical applications infrastructure | = 8.0.3.0.0 | No fix listed |
| oracle financial services analytical applications infrastructure | = 8.0.4.0.0 | No fix listed |
| oracle financial services analytical applications infrastructure | = 8.0.5.0.0 | No fix listed |
| oracle financial services analytical applications infrastructure | = 8.0.6.0.0 | No fix listed |
| oracle financial services analytical applications infrastructure | = 8.0.7.0.0 | No fix listed |
| oracle global lifecycle management opatchauto | < 12.2.0.1.14 | 12.2.0.1.14 |
| oracle primavera unifier | >= 17.1, <= 17.12 | No fix listed |
| oracle primavera unifier | = 16.1 | No fix listed |
| oracle primavera unifier | = 16.2 | No fix listed |
| oracle primavera unifier | = 18.8 | No fix listed |
| oracle utilities advanced spatial and operational analytics | = 2.7.0.1 | No fix listed |
| oracle webcenter portal | = 12.2.1.3.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking third-party-advisory
- github.com issue-tracking patch third-party-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com vendor-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com third-party-advisory
- DSA-4004 third-party-advisory vendor-advisory
- support.hpe.com third-party-advisory
- security.netapp.com third-party-advisory
- [debian-lts-announce] 20200824 [SECURITY] [DLA 2342-1] libjackson-json-java security update mailing-list third-party-advisory
- [debian-lts-announce] 20200131 [SECURITY] [DLA 2091-1] libjackson-json-java security update mailing-list third-party-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- RHSA-2017:1834 third-party-advisory vendor-advisory
- RHSA-2017:1835 third-party-advisory vendor-advisory
- RHSA-2017:1836 third-party-advisory vendor-advisory
- RHSA-2017:1837 third-party-advisory vendor-advisory
- RHSA-2017:1839 third-party-advisory vendor-advisory
- RHSA-2017:1840 third-party-advisory vendor-advisory
- RHSA-2017:2477 third-party-advisory vendor-advisory
- RHSA-2017:2546 third-party-advisory vendor-advisory
- RHSA-2017:2547 third-party-advisory vendor-advisory
- RHSA-2017:2633 third-party-advisory vendor-advisory
- RHSA-2017:2635 third-party-advisory vendor-advisory
- RHSA-2017:2636 third-party-advisory vendor-advisory
- RHSA-2017:2637 third-party-advisory vendor-advisory
- RHSA-2017:2638 third-party-advisory vendor-advisory
- RHSA-2017:3141 third-party-advisory vendor-advisory
- RHSA-2017:3454 third-party-advisory vendor-advisory
- RHSA-2017:3455 third-party-advisory vendor-advisory
- RHSA-2017:3456 third-party-advisory vendor-advisory
- RHSA-2017:3458 third-party-advisory vendor-advisory
- RHSA-2018:0294 third-party-advisory vendor-advisory
- RHSA-2018:0342 third-party-advisory vendor-advisory
- RHSA-2018:1449 third-party-advisory vendor-advisory
- RHSA-2018:1450 third-party-advisory vendor-advisory
- RHSA-2019:0910 third-party-advisory vendor-advisory
- RHSA-2019:2858 third-party-advisory vendor-advisory
- RHSA-2019:3149 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- cwiki.apache.org third-party-advisory
- github.com product
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- Debian Security Tracker CVE-2017-7525 vendor-advisory
- 1040360 third-party-advisory vdb-entry
- 1039744 third-party-advisory vdb-entry
- 1039947 third-party-advisory vdb-entry
- 99623 third-party-advisory vdb-entry
- [lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report mailing-list
- [lucene-dev] 20190325 [jira] [Closed] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ... mailing-list
- [lucene-dev] 20190325 [jira] [Updated] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ... mailing-list
- [lucene-dev] 20190325 [jira] [Assigned] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ... mailing-list
- [lucene-dev] 20190325 [jira] [Resolved] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ... mailing-list
- [lucene-dev] 20190325 [jira] [Updated] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ... mailing-list
- [cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15416) CVE-2017-7525 ( jackson-databind is vulnerable to Remote Code Execution) on version 3.11.4 mailing-list
- [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities mailing-list
- [lucene-solr-user] 20191218 CVE-2017-7525 fix for Solr 7.7.x mailing-list
- [lucene-solr-user] 20191218 Re: CVE-2017-7525 fix for Solr 7.7.x mailing-list
- [lucene-solr-user] 20191219 Re: CVE-2017-7525 fix for Solr 7.7.x mailing-list
- [spark-issues] 20210223 [jira] [Created] (SPARK-34511) Current Security vulnerabilities in spark libraries mailing-list
- [cassandra-commits] 20210927 [jira] [Commented] (CASSANDRA-15416) CVE-2017-7525 ( jackson-databind is vulnerable to Remote Code Execution) on version 3.11.4 mailing-list
- [cassandra-commits] 20210927 [jira] [Updated] (CASSANDRA-15416) CVE-2017-7525 ( jackson-databind is vulnerable to Remote Code Execution) on version 3.11.4 mailing-list
- bugs.debian.org issue-tracking