p PatchFirst

CVE-2017-15095

CVE-2017-15095

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

CVSS 9.8 · Critical · EPSS 8.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • jackson-databind

    Versions
    • before 2.8.10: Affected
    • before 2.9.1: Affected

    No fix published

  • jackson-databind Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.9.1-1

    Update to 2.9.1-1

  • jackson-databind Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.9.1-1

    Update to 2.9.1-1

  • jackson-databind Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.9.1-1

    Update to 2.9.1-1

  • libjackson-json-java Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.9.13-2

    Update to 1.9.13-2

  • libjackson-json-java Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.9.13-2

    Update to 1.9.13-2

  • libjackson-json-java Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.9.13-2

    Update to 1.9.13-2

  • jackson-databind Ubuntu:Pro:14.04:LTS

    Versions
    • 2.2.2-1
    Affected ranges
    • ECOSYSTEM: < 2.2.2-1ubuntu0.1~esm1

    Update to 2.2.2-1ubuntu0.1~esm1

  • libjackson-json-java Ubuntu:Pro:14.04:LTS

    Versions
    • 1.9.2-1
    • 1.9.2-2
    • 1.9.2-3
    Affected ranges
    • ECOSYSTEM: < 1.9.2-3+deb8u1build0.14.04.1~esm1

    Update to 1.9.2-3+deb8u1build0.14.04.1~esm1

  • libjackson-json-java Ubuntu:16.04:LTS

    Versions
    • 1.9.2-3
    • 1.9.2-4
    • 1.9.2-5
    • 1.9.2-6
    • 1.9.2-7
    Affected ranges
    • ECOSYSTEM: < 1.9.2-7ubuntu0.2

    Update to 1.9.2-7ubuntu0.2

  • jackson-databind Ubuntu:Pro:16.04:LTS

    Versions
    • 2.4.2-2
    • 2.4.2-3
    Affected ranges
    • ECOSYSTEM: < 2.4.2-3ubuntu0.1~esm1

    Update to 2.4.2-3ubuntu0.1~esm1

  • libjackson-json-java Ubuntu:18.04:LTS

    Versions
    • 1.9.2-8
    • 1.9.2-9
    • 1.9.13-1~18.04
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libjackson-json-java Ubuntu:20.04:LTS

    Versions
    • 1.9.13-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →