CVEvulnerability

CVE-2017-7525

9.8 CRITICAL Published 2018-02-06 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2018-02-06
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-184, CWE-502

Description

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

Affected configurations

• fasterxml jackson-databind (< 2.6.7.1) • fasterxml jackson-databind (>= 2.7.0 < 2.7.9.1) • fasterxml jackson-databind (>= 2.8.0 < 2.8.9) • fasterxml jackson-databind 2.9.0 • debian debian linux 8.0 • debian debian linux 9.0 • netapp oncommand balance • netapp oncommand performance manager • netapp oncommand shift • netapp snapcenter • redhat openshift container platform 4.1 • redhat virtualization 4.0 • redhat virtualization host 4.0 • redhat jboss enterprise application platform 6.0.0 • redhat jboss enterprise application platform 6.4.0 • redhat jboss enterprise application platform 7.0 • redhat jboss enterprise application platform 7.1 • redhat openshift container platform 3.11 • oracle banking platform 2.5.0 • oracle banking platform 2.6.0 • oracle banking platform 2.6.1 • oracle banking platform 2.6.2 • oracle communications billing and revenue management 7.5 • oracle communications billing and revenue management 12.0 • oracle communications communications policy management (>= 12.0 <= 12.5.2) • oracle communications diameter signaling route (< 8.3) • oracle communications instant messaging server 10.0.1 • oracle communications instant messaging server 10.0.1.2.0 • oracle enterprise manager for virtualization 13.2.2 • oracle enterprise manager for virtualization 13.2.3 • oracle enterprise manager for virtualization 13.3.1 • oracle financial services analytical applications infrastructure 8.0.2.0.0 • oracle financial services analytical applications infrastructure 8.0.3.0.0 • oracle financial services analytical applications infrastructure 8.0.4.0.0 • oracle financial services analytical applications infrastructure 8.0.5.0.0 • oracle financial services analytical applications infrastructure 8.0.6.0.0 • oracle financial services analytical applications infrastructure 8.0.7.0.0 • oracle global lifecycle management opatchauto (< 12.2.0.1.14) • oracle primavera unifier (>= 17.1 <= 17.12) • oracle primavera unifier 16.1 • oracle primavera unifier 16.2 • oracle primavera unifier 18.8 • oracle utilities advanced spatial and operational analytics 2.7.0.1 • oracle webcenter portal 12.2.1.3.0

Related

Weakness · CWE (2)

  • CWE-184 Incomplete List of Disallowed Inputs weakness
  • CWE-502 Deserialization of Untrusted Data weakness

References