CVE-2017-15095

CWE-184CWE-502 — Deserialization of Untrusted Data16 documents8 sources
Severity
9.8CRITICAL
EPSS
8.6%
top 7.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
21
Fasterxml Jackson-databindOracle Communications Diameter Signaling RouterOracle Global Lifecycle Management Opatchauto+18 more
Timeline
PublishedFeb 6
Latest updateMay 24

Description

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages23 packages

▶NVDfasterxml/jackson-databind2.0.0 — 2.6.7.2+3
▶Debianjackson-databind< 2.9.1-1+3
▶CVEListV5fasterxml/jackson-databindbefore 2.8.10, before 2.9.1+1
▶Debianlibjackson-json-java< 1.9.13-2+3

Also affects: Debian Linux 8.0, 9.0, Openshift Container Platform 3.11, 4.1

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

5
GHSA
Deserialization of Untrusted Data in org.codehaus.jackson:jackson-mapper-asl↗2022-05-24
▶
OSV
jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution↗2018-10-18
▶
GHSA
jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution↗2018-10-18
▶
CVEList
CVE-2017-15095: A deserialization flaw was discovered in the jackson-databind in versions before 2↗2018-02-06
▶
OSV
CVE-2017-15095: A deserialization flaw was discovered in the jackson-databind in versions before 2↗2018-02-06
▶

📋Vendor Advisories

5
Ubuntu
Jackson vulnerabilities↗2021-02-18
▶
Red Hat
codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities↗2019-09-30
▶
Red Hat
jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095)↗2017-12-12
▶
Red Hat
jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525)↗2017-11-02
▶
Debian
CVE-2017-15095: jackson-databind - A deserialization flaw was discovered in the jackson-databind in versions before...↗2017
▶

💬Community

5
Bugzilla
CVE-2019-10202 codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities↗2019-07-18
▶
Bugzilla
CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) [fedora-all]↗2018-01-03
▶
Bugzilla
CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095)↗2017-12-22
▶
Bugzilla
CVE-2017-15095 jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) [fedora-all]↗2017-11-02
▶
Bugzilla
CVE-2017-15095 jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525)↗2017-10-26
▶