Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2017-15095GHSA-H592-38CM-4GGP

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 2.8.11, 2.9.4, 2.6.7.3, 2.7.9.2
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: yes
  • Technical impact: total

Summary

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: yes · Technical impact: total

  3. Record last updated

Affected versions

  • FasterXML jackson-databind

    before 2.8.10, before 2.9.1

  • com.fasterxml.jackson.core:jackson-databindMaven

    From 2.8.0 · fixed in 2.8.11

  • com.fasterxml.jackson.core:jackson-databindMaven

    From 2.9.0 · fixed in 2.9.4

  • com.fasterxml.jackson.core:jackson-databindMaven

    From 2.0.0 · fixed in 2.6.7.3

  • com.fasterxml.jackson.core:jackson-databindMaven

    From 2.7.0 · fixed in 2.7.9.2

References 25

access.redhat.com

securityfocus.com

securitytracker.com

debian.org

lists.apache.org

lists.debian.org

oracle.com