kritisch
CVE-2017-15095
jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525)
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA. Niedriger laut Red Hat (hoch), Ubuntu (mittel).
Beschreibung
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| maven::GitHub Security Advisory Maven | com.fasterxml.jackson.core:jackson-databind | 2.8.11, 2.9.4, 2.6.7.3, 2.7.9.2 |
| debian 10 | libjackson-json-java | 1.9.13-2~deb10u1 |
| debian 11 | jackson-databind, libjackson-json-java | 2.9.1-1 und 1 weitere |
| debian 12 | jackson-databind, libjackson-json-java | 2.9.1-1 und 1 weitere |
| debian 13 | jackson-databind, libjackson-json-java | 2.9.1-1 und 1 weitere |
| debian 14 | jackson-databind, libjackson-json-java | 2.9.1-1 und 1 weitere |
| debian 8 | jackson-databind, libjackson-json-java | 2.4.2-2+deb8u2 und 1 weitere |
| debian 9 | jackson-databind, libjackson-json-java | 2.8.6-1+deb9u2 und 1 weitere |
| echo | jackson-databind, libjackson-json-java | 2.9.1-1 und 1 weitere |
| Red Hat | elasticsearch-cloud-kubernetes, openshift-elasticsearch-plugin | kein Fix angegeben |
| ubuntu 14.04-ESM | jackson-databind, libjackson-json-java | 2.2.2-1ubuntu0.1~esm1 und 1 weitere |
| ubuntu 16.04 | libjackson-json-java | 1.9.2-7ubuntu0.2 |
Alle 25 Einträge aus 15 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| maven::GitHub Security Advisory Maven | com.fasterxml.jackson.core:jackson-databind | 2.8.11, 2.9.4, 2.6.7.3, 2.7.9.2 |
| debian 10 | libjackson-json-java | 1.9.13-2~deb10u1 |
| debian 11 | jackson-databind | 2.9.1-1 |
| debian 11 | libjackson-json-java | 1.9.13-2 |
| debian 12 | jackson-databind | 2.9.1-1 |
| debian 12 | libjackson-json-java | 1.9.13-2 |
| debian 13 | jackson-databind | 2.9.1-1 |
| debian 13 | libjackson-json-java | 1.9.13-2 |
| debian 14 | jackson-databind | 2.9.1-1 |
| debian 14 | libjackson-json-java | 1.9.13-2 |
| debian 8 | jackson-databind | 2.4.2-2+deb8u2 |
| debian 8 | libjackson-json-java | 1.9.2-3+deb8u1 |
| debian 9 | jackson-databind | 2.8.6-1+deb9u2 |
| debian 9 | libjackson-json-java | 1.9.2-8+deb9u1 |
| echo | jackson-databind | 2.9.1-1 |
| echo | libjackson-json-java | 1.9.13-2 |
| Red Hat | elasticsearch-cloud-kubernetes | kein Fix angegeben |
| Red Hat | openshift-elasticsearch-plugin | kein Fix angegeben |
| ubuntu 14.04-ESM | jackson-databind | 2.2.2-1ubuntu0.1~esm1 |
| ubuntu 14.04-ESM | libjackson-json-java | 1.9.2-3+deb8u1build0.14.04.1~esm1 |
| ubuntu 16.04 | libjackson-json-java | 1.9.2-7ubuntu0.2 |
| ubuntu 16.04-ESM | jackson-databind | 2.4.2-3ubuntu0.1~esm1 |
| ubuntu 16.04-ESM | libjackson-json-java | 1.9.2-7ubuntu0.2 |
| ubuntu 17.04 | jackson-databind | 2.8.6-1+deb9u2build0.17.04.1 |
| ubuntu 17.10 | jackson-databind | 2.8.6-1+deb9u2build0.17.10.1 |
Referenzen
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/103880
- http://www.securitytracker.com/id/1039769
- https://access.redhat.com/errata/RHSA-2017:3189
- https://access.redhat.com/errata/RHSA-2017:3190
- https://access.redhat.com/errata/RHSA-2018:0342
Alle 52 Referenzen
- https://access.redhat.com/errata/RHSA-2018:0478
- https://access.redhat.com/errata/RHSA-2018:0479
- https://access.redhat.com/errata/RHSA-2018:0480
- https://access.redhat.com/errata/RHSA-2018:0481
- https://access.redhat.com/errata/RHSA-2018:0576
- https://access.redhat.com/errata/RHSA-2018:0577
- https://access.redhat.com/errata/RHSA-2018:1447
- https://access.redhat.com/errata/RHSA-2018:1448
- https://access.redhat.com/errata/RHSA-2018:1449
- https://access.redhat.com/errata/RHSA-2018:1450
- https://access.redhat.com/errata/RHSA-2018:1451
- https://access.redhat.com/errata/RHSA-2018:2927
- https://access.redhat.com/errata/RHSA-2019:2858
- https://access.redhat.com/errata/RHSA-2019:3149
- https://access.redhat.com/errata/RHSA-2019:3892
- https://access.redhat.com/security/cve/CVE-2017-15095
- https://access.redhat.com/solutions/3442891
- https://github.com/FasterXML/jackson-databind
- https://github.com/FasterXML/jackson-databind/blob/7093008aa2afe8068e120df850189ae072dfa1b2/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java#L43
- https://github.com/FasterXML/jackson-databind/commit/3bfbb835
- https://github.com/FasterXML/jackson-databind/commit/a054585e2175ad0882f07bcafedecfac86230f1b
- https://github.com/FasterXML/jackson-databind/commit/a3939d36edcc755c8af55bdc1969e0fa8438f9db
- https://github.com/FasterXML/jackson-databind/commit/ddfddfba
- https://github.com/FasterXML/jackson-databind/commit/ddfddfba6414adbecaff99684ef66eebd3a92e92
- https://github.com/FasterXML/jackson-databind/commit/e865a7a4464da63ded9f4b1a2328ad85c9ded78b
- https://github.com/FasterXML/jackson-databind/commit/e8f043d1
- https://github.com/FasterXML/jackson-databind/commit/e8f043d1aac9b82eee907e0f0c3abbdea723a935
- https://github.com/FasterXML/jackson-databind/issues/1680
- https://github.com/FasterXML/jackson-databind/issues/1723
- https://github.com/FasterXML/jackson-databind/issues/1737
- https://github.com/tolbertam/jackson-databind/commit/80566a0f96b2003863f9d8f9ccc3b562001e147b
- https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629@%3Csolr-user.lucene.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-15095
- https://security.netapp.com/advisory/ntap-20171214-0003
- https://security.netapp.com/advisory/ntap-20171214-0003/
- https://ubuntu.com/security/notices/USN-4741-1
- https://web.archive.org/web/20200401000000%2A/http://www.securityfocus.com/bid/103880
- https://web.archive.org/web/20201221192044/http://www.securitytracker.com/id/1039769
- https://www.cve.org/CVERecord?id=CVE-2017-15095
- https://www.debian.org/security/2017/dsa-4037
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html