jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution

심각 9.8CVE-2017-15095 · GHSA-h592-38cm-4ggp · Published 06/02/2018 · updated 08/10/2026

요약

CVE-2017-15095은(는) com.fasterxml.jackson.core:jackson-databind, jackson-databind (fasterxml), banking platform (oracle)에 영향을 주는 심각 (CVSS 9.8) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 8.4%, 전체 취약점의 95.0%보다 높음.
조치: 2.6.7.3, 2.7.9.2, 2.8.11, 2.9.4 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
com.fasterxml.jackson.core:jackson-databind Maven	`≥ 2.0.0, < 2.6.7.3≥ 2.7.0, < 2.7.9.2≥ 2.8.0, < 2.8.11≥ 2.9.0, < 2.9.4`	`2.6.7.32.7.9.22.8.112.9.4`
jackson-databind fasterxml	`= 2.9.0≥ 2.0.0, < 2.6.7.2≥ 2.7.0, < 2.7.9.2≥ 2.8.0, < 2.8.10`	`2.6.7.22.7.9.22.8.10`
banking platform oracle	`= 2.5.0= 2.6.0= 2.6.1= 2.6.2`	No fix yet
clusterware oracle	`= 12.1.0.2.0`	No fix yet
communications billing and revenue management oracle	`= 12.0= 7.5`	No fix yet
communications diameter signaling router oracle	`< 8.3`	`8.3`
communications instant messaging server oracle	`= 10.0.1.2.0`	No fix yet
database server oracle	`= 12.2.0.1= 18.1`	No fix yet
enterprise manager for virtualization oracle	`= 13.2.2= 13.2.3= 13.3.1`	No fix yet
financial services analytical applications infrastructure oracle	`= 8.0.2= 8.0.3= 8.0.4= 8.0.5= 8.0.6= 8.0.7`	No fix yet
global lifecycle management opatchauto oracle	`< 12.2.0.1.14`	`12.2.0.1.14`
identity manager oracle	`= 11.1.2.3.0= 12.2.1.3.0`	No fix yet
jd edwards enterpriseone tools oracle	`= 9.2`	No fix yet
primavera unifier oracle	`= 16.1= 16.2= 18.8≥ 17.1, ≤ 17.12`	No fix yet
utilities advanced spatial and operational analytics oracle	`= 2.7.0.1`	No fix yet
webcenter portal oracle	`= 12.2.1.3.0`	No fix yet
jboss enterprise application platform redhat	`= 6.0.0= 6.4.0= 7.1.0`	No fix yet
openshift container platform redhat	`= 3.11= 4.1`	No fix yet
satellite redhat	`= 6.4`	No fix yet
satellite capsule redhat	`= 6.4`	No fix yet

Description

jackson-databind in versions prior to 2.8.11 and 2.9.4 contain a deserialization flaw which allows an unauthenticated user to perform code execution by sending maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525, blacklisting additonal vulnerable classes.

NVD description

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

References

nvd.nist.gov/vuln/detail/CVE-2017-15095 · ADVISORY
FasterXML/jackson-databind · WEB
FasterXML/jackson-databind · WEB
FasterXML/jackson-databind commit a054585 · WEB
FasterXML/jackson-databind commit a3939d3 · WEB
FasterXML/jackson-databind commit ddfddfb · WEB
FasterXML/jackson-databind commit e865a7a · WEB
FasterXML/jackson-databind commit e8f043d · WEB
tolbertam/jackson-databind commit 80566a0 · WEB
access.redhat.com/errata/RHSA-2017:3189 · WEB

com.fasterxml.jackson.core:jackson-databind의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free