p PatchFirst

CVE-2017-7525

CVE-2017-7525

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

CVSS 9.8 · Critical · EPSS 37.7% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • jackson-databind

    Versions
    • before 2.6.7.1: Affected
    • before 2.7.9.1: Affected
    • before 2.8.9: Affected

    No fix published

  • jackson-databind Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.9.1-1

    Update to 2.9.1-1

  • jackson-databind Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.9.1-1

    Update to 2.9.1-1

  • jackson-databind Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.9.1-1

    Update to 2.9.1-1

  • libjackson-json-java Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.9.13-2

    Update to 1.9.13-2

  • libjackson-json-java Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.9.13-2

    Update to 1.9.13-2

  • libjackson-json-java Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.9.13-2

    Update to 1.9.13-2

  • jackson-databind Ubuntu:Pro:14.04:LTS

    Versions
    • 2.2.2-1
    Affected ranges
    • ECOSYSTEM: < 2.2.2-1ubuntu0.1~esm1

    Update to 2.2.2-1ubuntu0.1~esm1

  • libjackson-json-java Ubuntu:Pro:14.04:LTS

    Versions
    • 1.9.2-1
    • 1.9.2-2
    • 1.9.2-3
    Affected ranges
    • ECOSYSTEM: < 1.9.2-3+deb8u1build0.14.04.1~esm1

    Update to 1.9.2-3+deb8u1build0.14.04.1~esm1

  • libjackson-json-java Ubuntu:16.04:LTS

    Versions
    • 1.9.2-3
    • 1.9.2-4
    • 1.9.2-5
    • 1.9.2-6
    • 1.9.2-7
    Affected ranges
    • ECOSYSTEM: < 1.9.2-7ubuntu0.2

    Update to 1.9.2-7ubuntu0.2

  • jackson-databind Ubuntu:Pro:16.04:LTS

    Versions
    • 2.4.2-2
    • 2.4.2-3
    Affected ranges
    • ECOSYSTEM: < 2.4.2-3ubuntu0.1~esm1

    Update to 2.4.2-3ubuntu0.1~esm1

  • libjackson-json-java Ubuntu:18.04:LTS

    Versions
    • 1.9.2-8
    • 1.9.2-9
    • 1.9.13-1~18.04
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libjackson-json-java Ubuntu:20.04:LTS

    Versions
    • 1.9.13-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →