CVEvulnerability

CVE-2017-15095

9.8 CRITICAL Published 2018-02-06 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2018-02-06
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-184, CWE-502

Description

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

Affected configurations

• fasterxml jackson-databind (>= 2.0.0 < 2.6.7.2) • fasterxml jackson-databind (>= 2.7.0 < 2.7.9.2) • fasterxml jackson-databind (>= 2.8.0 < 2.8.10) • fasterxml jackson-databind 2.9.0 • debian debian linux 8.0 • debian debian linux 9.0 • redhat openshift container platform 3.11 • redhat satellite 6.4 • redhat satellite capsule 6.4 • redhat openshift container platform 4.1 • redhat jboss enterprise application platform 6.0.0 • redhat jboss enterprise application platform 6.4.0 • redhat jboss enterprise application platform 7.1.0 • netapp oncommand balance • netapp oncommand performance manager • netapp oncommand shift • netapp snapcenter • oracle banking platform 2.5.0 • oracle banking platform 2.6.0 • oracle banking platform 2.6.1 • oracle banking platform 2.6.2 • oracle clusterware 12.1.0.2.0 • oracle communications billing and revenue management 7.5 • oracle communications billing and revenue management 12.0 • oracle communications diameter signaling router (< 8.3) • oracle communications instant messaging server 10.0.1.2.0 • oracle database server 12.2.0.1 • oracle database server 18.1 • oracle enterprise manager for virtualization 13.2.2 • oracle enterprise manager for virtualization 13.2.3 • oracle enterprise manager for virtualization 13.3.1 • oracle financial services analytical applications infrastructure 8.0.2 • oracle financial services analytical applications infrastructure 8.0.3 • oracle financial services analytical applications infrastructure 8.0.4 • oracle financial services analytical applications infrastructure 8.0.5 • oracle financial services analytical applications infrastructure 8.0.6 • oracle financial services analytical applications infrastructure 8.0.7 • oracle global lifecycle management opatchauto (< 12.2.0.1.14) • oracle identity manager 11.1.2.3.0 • oracle identity manager 12.2.1.3.0 • oracle jd edwards enterpriseone tools 9.2 • oracle primavera unifier (>= 17.1 <= 17.12) • oracle primavera unifier 16.1 • oracle primavera unifier 16.2 • oracle primavera unifier 18.8 • oracle utilities advanced spatial and operational analytics 2.7.0.1 • oracle webcenter portal 12.2.1.3.0

Related

Weakness · CWE (2)

  • CWE-184 Incomplete List of Disallowed Inputs weakness
  • CWE-502 Deserialization of Untrusted Data weakness

References