GitHub Advisoryadvisory · Maven

GHSA-qxxx-2pp7-5hmx jackson-databind is vulnerable to a deserialization flaw

CRITICAL Published 2018-10-16 Modified 2024-03-01 Official page ↗
Aliases
CVE-2017-7525
Ecosystem
Maven
Packages
com.fasterxml.jackson.core:jackson-databind
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-184, CWE-502
Reviewed
2020-06-16

Affected packages

• Maven com.fasterxml.jackson.core:jackson-databind: < 2.6.7.1 → fixed in 2.6.7.1 • Maven com.fasterxml.jackson.core:jackson-databind: >= 2.7.0, < 2.7.9.1 → fixed in 2.7.9.1 • Maven com.fasterxml.jackson.core:jackson-databind: >= 2.8.0, < 2.8.9 → fixed in 2.8.9

Description

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

Related

Alias · CVE (1)

  • CVE-2017-7525 A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an… vulnerability

Weakness · CWE (2)

  • CWE-184 Incomplete List of Disallowed Inputs weakness
  • CWE-502 Deserialization of Untrusted Data weakness

References