logo

Database

Insecure deserialization In com.fasterxml.jackson.core:jackson-databind

Description

jackson-databind is vulnerable to a deserialization flaw A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2017-75252. NVD-2017-75253. OSV-2017-75254. OSV-DEBIAN-2017-75255. GHSA-qxxx-2pp7-5hmx6. GCVE-2017-75257. lists.debian.org8. lists.debian.org9. access.redhat.com10. access.redhat.com11. access.redhat.com12. access.redhat.com13. access.redhat.com14. access.redhat.com15. access.redhat.com16. access.redhat.com17. access.redhat.com18. access.redhat.com19. access.redhat.com20. access.redhat.com21. access.redhat.com22. access.redhat.com23. access.redhat.com24. access.redhat.com25. access.redhat.com26. access.redhat.com27. access.redhat.com28. access.redhat.com29. access.redhat.com30. access.redhat.com31. access.redhat.com32. access.redhat.com33. access.redhat.com34. access.redhat.com35. SECURITY-TRACKER-CVE-2017-7525

References

1. https://github.com/FasterXML/jackson-databind/issues/17232. https://github.com/FasterXML/jackson-databind/issues/15993. https://github.com/FasterXML/jackson-databind/commit/fd8dec2c7fab8b4b4bd60502a0f1d63ec23c24da4. https://github.com/FasterXML/jackson-databind/commit/fa87c1ddbe803ebb7295f5c2ebfe38e12f6e61625. https://github.com/FasterXML/jackson-databind/commit/3bfbb835e530055c1941ddf87fde0b08d08dcd386. https://github.com/FasterXML/jackson-databind/commit/60d459cedcf079c6106ae7da2ac562bc32dcabe17. https://github.com/FasterXML/jackson-databind/commit/680d75b011edd67a2d2a2e9980998a968194c2ef8. https://github.com/FasterXML/jackson-databind/commit/6ce32ffd18facac6abdbbf559c817b47fcb622c19. https://github.com/FasterXML/jackson-databind/commit/90042692085deeb05ae75c569c9909f7dba2441510. https://lists.apache.org/thread.html/3c87dc8bca99a2b3b4743713b33d1de05b1d6b761fdf316224e9c81f@%3Cdev.lucene.apache.org%3E11. https://lists.apache.org/thread.html/4641ed8616ccc2c1fbddac2c3dc9900c96387bc226eaf0232d61909b@%3Ccommits.cassandra.apache.org%3E12. https://lists.apache.org/thread.html/5008bcbd45ee65ce39e4220b6ac53d28a24d6bc67d5804e9773a7399@%3Csolr-user.lucene.apache.org%3E13. https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E14. https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E15. https://lists.apache.org/thread.html/b1f33fe5ade396bb903fdcabe9f243f7692c7dfce5418d3743c2d346@%3Cdev.lucene.apache.org%3E16. https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html17. https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html18. https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html19. https://www.oracle.com/security-alerts/cpuoct2020.html20. https://www.debian.org/security/2017/dsa-400421. https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us22. https://security.netapp.com/advisory/ntap-20171214-000223. https://lists.apache.org/thread.html/rf7f87810c38dc9abf9f93989f76008f504cbf7c1a355214640b2d04c@%3Ccommits.cassandra.apache.org%3E24. https://lists.apache.org/thread.html/r68acf97f4526ba59a33cc6e592261ea4f85d890f99e79c82d57dd589@%3Cissues.spark.apache.org%3E25. https://lists.apache.org/thread.html/r42ac3e39e6265db12d9fc6ae1cd4b5fea7aed9830dc6f6d58228fed7@%3Ccommits.cassandra.apache.org%3E26. https://lists.apache.org/thread.html/f60afd3c7e9ebaaf70fad4a4beb75cf8740ac959017a31e7006c7486@%3Cdev.lucene.apache.org%3E27. https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629@%3Csolr-user.lucene.apache.org%3E28. https://lists.apache.org/thread.html/c9d5ff20929e8a3c8794facf4c4b326a9c10618812eec356caa20b87@%3Csolr-user.lucene.apache.org%3E29. https://lists.apache.org/thread.html/c2ed4c0126b43e324cf740012a0edd371fd36096fd777be7bfe7a2a6@%3Cdev.lucene.apache.org%3E30. https://lists.apache.org/thread.html/c10a2bf0fdc3d25faf17bd191d6ec46b29a353fa9c97bebd7c4e5913@%3Cdev.lucene.apache.org%3E31. https://bugzilla.redhat.com/show_bug.cgi?id=146270232. https://cwiki.apache.org/confluence/display/WW/S2-05533. http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html34. http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html35. http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html36. https://github.com/SecureSkyTechnology/study-struts2-s2-054_055-jackson-cve-2017-7525_cve-2017-15095

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.