jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution

緊急 9.8CVE-2017-15095 · GHSA-h592-38cm-4ggp · 06/02/2018 公開 · 08/10/2026 更新

要点

CVE-2017-15095 は com.fasterxml.jackson.core:jackson-databind, jackson-databind (fasterxml), banking platform (oracle) に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：8.4%（全脆弱性の 95.0% より高い）。
対処：2.6.7.3, 2.7.9.2, 2.8.11, 2.9.4 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
com.fasterxml.jackson.core:jackson-databind Maven	`≥ 2.0.0, < 2.6.7.3≥ 2.7.0, < 2.7.9.2≥ 2.8.0, < 2.8.11≥ 2.9.0, < 2.9.4`	`2.6.7.32.7.9.22.8.112.9.4`
jackson-databind fasterxml	`= 2.9.0≥ 2.0.0, < 2.6.7.2≥ 2.7.0, < 2.7.9.2≥ 2.8.0, < 2.8.10`	`2.6.7.22.7.9.22.8.10`
banking platform oracle	`= 2.5.0= 2.6.0= 2.6.1= 2.6.2`	修正版なし
clusterware oracle	`= 12.1.0.2.0`	修正版なし
communications billing and revenue management oracle	`= 12.0= 7.5`	修正版なし
communications diameter signaling router oracle	`< 8.3`	`8.3`
communications instant messaging server oracle	`= 10.0.1.2.0`	修正版なし
database server oracle	`= 12.2.0.1= 18.1`	修正版なし
enterprise manager for virtualization oracle	`= 13.2.2= 13.2.3= 13.3.1`	修正版なし
financial services analytical applications infrastructure oracle	`= 8.0.2= 8.0.3= 8.0.4= 8.0.5= 8.0.6= 8.0.7`	修正版なし
global lifecycle management opatchauto oracle	`< 12.2.0.1.14`	`12.2.0.1.14`
identity manager oracle	`= 11.1.2.3.0= 12.2.1.3.0`	修正版なし
jd edwards enterpriseone tools oracle	`= 9.2`	修正版なし
primavera unifier oracle	`= 16.1= 16.2= 18.8≥ 17.1, ≤ 17.12`	修正版なし
utilities advanced spatial and operational analytics oracle	`= 2.7.0.1`	修正版なし
webcenter portal oracle	`= 12.2.1.3.0`	修正版なし
jboss enterprise application platform redhat	`= 6.0.0= 6.4.0= 7.1.0`	修正版なし
openshift container platform redhat	`= 3.11= 4.1`	修正版なし
satellite redhat	`= 6.4`	修正版なし
satellite capsule redhat	`= 6.4`	修正版なし

概要

jackson-databind in versions prior to 2.8.11 and 2.9.4 contain a deserialization flaw which allows an unauthenticated user to perform code execution by sending maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525, blacklisting additonal vulnerable classes.

NVD の説明

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.