CVE-2017-15095
06.02.2018, 15:29
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.Enginsight
| Vendor | Product | Version |
|---|---|---|
| fasterxml | jackson-databind | 2.0.0 ≤ 𝑥 < 2.6.7.2 |
| fasterxml | jackson-databind | 2.7.0 ≤ 𝑥 < 2.7.9.2 |
| fasterxml | jackson-databind | 2.8.0 ≤ 𝑥 < 2.8.10 |
| fasterxml | jackson-databind | 2.9.0 |
| fasterxml | jackson-databind | 2.9.0:prerelease1 |
| fasterxml | jackson-databind | 2.9.0:prerelease2 |
| fasterxml | jackson-databind | 2.9.0:prerelease3 |
| fasterxml | jackson-databind | 2.9.0:prerelease4 |
| debian | debian_linux | 8.0 |
| debian | debian_linux | 9.0 |
| redhat | openshift_container_platform | 3.11 |
| redhat | satellite | 6.4 |
| redhat | satellite_capsule | 6.4 |
| redhat | openshift_container_platform | 4.1 |
| redhat | jboss_enterprise_application_platform | 6.0.0 |
| redhat | jboss_enterprise_application_platform | 6.4.0 |
| redhat | jboss_enterprise_application_platform | 7.1.0 |
| netapp | oncommand_balance | - |
| netapp | oncommand_performance_manager | - |
| netapp | oncommand_performance_manager | - |
| netapp | oncommand_shift | - |
| netapp | snapcenter | - |
| oracle | banking_platform | 2.5.0 |
| oracle | banking_platform | 2.6.0 |
| oracle | banking_platform | 2.6.1 |
| oracle | banking_platform | 2.6.2 |
| oracle | clusterware | 12.1.0.2.0 |
| oracle | communications_billing_and_revenue_management | 7.5 |
| oracle | communications_billing_and_revenue_management | 12.0 |
| oracle | communications_diameter_signaling_router | 𝑥 < 8.3 |
| oracle | communications_instant_messaging_server | 10.0.1.2.0 |
| oracle | database_server | 12.2.0.1 |
| oracle | database_server | 18.1 |
| oracle | enterprise_manager_for_virtualization | 13.2.2 |
| oracle | enterprise_manager_for_virtualization | 13.2.3 |
| oracle | enterprise_manager_for_virtualization | 13.3.1 |
| oracle | financial_services_analytical_applications_infrastructure | 8.0.2 |
| oracle | financial_services_analytical_applications_infrastructure | 8.0.3 |
| oracle | financial_services_analytical_applications_infrastructure | 8.0.4 |
| oracle | financial_services_analytical_applications_infrastructure | 8.0.5 |
| oracle | financial_services_analytical_applications_infrastructure | 8.0.6 |
| oracle | financial_services_analytical_applications_infrastructure | 8.0.7 |
| oracle | global_lifecycle_management_opatchauto | 𝑥 < 12.2.0.1.14 |
| oracle | identity_manager | 11.1.2.3.0 |
| oracle | identity_manager | 12.2.1.3.0 |
| oracle | jd_edwards_enterpriseone_tools | 9.2 |
| oracle | primavera_unifier | 17.1 ≤ 𝑥 ≤ 17.12 |
| oracle | primavera_unifier | 16.1 |
| oracle | primavera_unifier | 16.2 |
| oracle | primavera_unifier | 18.8 |
| oracle | utilities_advanced_spatial_and_operational_analytics | 2.7.0.1 |
| oracle | webcenter_portal | 12.2.1.3.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| jackson-databind |
| ||||||||||||||||||||||||||||||||||
| libjackson-json-java |
|
Common Weakness Enumeration
- CWE-184 - Incomplete List of Disallowed InputsThe product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses.
- CWE-502 - Deserialization of Untrusted DataThe application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
References