CVE-2017-15095

jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525)

Severity Score

9.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

Se ha descubierto un error de deserialización en jackson-databind, en versiones anteriores a la 2.8.10 y a la 2.9.1, que podría permitir que un usuario no autenticado ejecute código enviando las entradas maliciosamente manipuladas al método readValue de ObjectMapper. Este problema amplía el error previo de CVE-2017-7525 metiendo en la lista negra más clases que podrían emplearse de forma maliciosa.

A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2017-10-08 CVE Reserved
2017-11-13 CVE Published
2024-09-16 CVE Updated
2024-09-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-184: Incomplete List of Disallowed Inputs
CWE-502: Deserialization of Untrusted Data

CAPEC

References (35)

URL	Tag	Source
http://www.securityfocus.com/bid/103880	Third Party Advisory
http://www.securitytracker.com/id/1039769	Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/1680	Issue Tracking
https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629%40%3Csolr-user.lucene.apache.org%3E	Mailing List
https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html	Mailing List
https://security.netapp.com/advisory/ntap-20171214-0003	Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html	2023-11-07
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html	2023-11-07
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html	2023-11-07
https://github.com/FasterXML/jackson-databind/issues/1737	2023-11-07
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html	2023-11-07
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html	2023-11-07

URL	Date	SRC
https://access.redhat.com/errata/RHSA-2017:3189	2023-11-07
https://access.redhat.com/errata/RHSA-2017:3190	2023-11-07
https://access.redhat.com/errata/RHSA-2018:0342	2023-11-07
https://access.redhat.com/errata/RHSA-2018:0478	2023-11-07
https://access.redhat.com/errata/RHSA-2018:0479	2023-11-07
https://access.redhat.com/errata/RHSA-2018:0480	2023-11-07
https://access.redhat.com/errata/RHSA-2018:0481	2023-11-07
https://access.redhat.com/errata/RHSA-2018:0576	2023-11-07
https://access.redhat.com/errata/RHSA-2018:0577	2023-11-07
https://access.redhat.com/errata/RHSA-2018:1447	2023-11-07
https://access.redhat.com/errata/RHSA-2018:1448	2023-11-07
https://access.redhat.com/errata/RHSA-2018:1449	2023-11-07
https://access.redhat.com/errata/RHSA-2018:1450	2023-11-07
https://access.redhat.com/errata/RHSA-2018:1451	2023-11-07
https://access.redhat.com/errata/RHSA-2018:2927	2023-11-07
https://access.redhat.com/errata/RHSA-2019:2858	2023-11-07
https://access.redhat.com/errata/RHSA-2019:3149	2023-11-07
https://access.redhat.com/errata/RHSA-2019:3892	2023-11-07
https://www.debian.org/security/2017/dsa-4037	2023-11-07
https://access.redhat.com/security/cve/CVE-2017-15095	2019-11-14
https://bugzilla.redhat.com/show_bug.cgi?id=1506612	2019-11-14
https://access.redhat.com/solutions/3442891	2019-11-14

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Redhat Search vendor "Redhat"	Openshift Container Platform Search vendor "Redhat" for product "Openshift Container Platform"	4.1 Search vendor "Redhat" for product "Openshift Container Platform" and version "4.1"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"	7.0 Search vendor "Redhat" for product "Enterprise Linux" and version "7.0"	-	Safe
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	6.0.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.0.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"	5.0 Search vendor "Redhat" for product "Enterprise Linux" and version "5.0"	-	Safe
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	6.0.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.0.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"	6.0 Search vendor "Redhat" for product "Enterprise Linux" and version "6.0"	-	Safe
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	6.0.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.0.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"	7.0 Search vendor "Redhat" for product "Enterprise Linux" and version "7.0"	-	Safe
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	6.4.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.4.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"	5.0 Search vendor "Redhat" for product "Enterprise Linux" and version "5.0"	-	Safe
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	6.4.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.4.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"	6.0 Search vendor "Redhat" for product "Enterprise Linux" and version "6.0"	-	Safe
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	6.4.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.4.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"	7.0 Search vendor "Redhat" for product "Enterprise Linux" and version "7.0"	-	Safe
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	7.1.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "7.1.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"	6.0 Search vendor "Redhat" for product "Enterprise Linux" and version "6.0"	-	Safe
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	7.1.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "7.1.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"	7.0 Search vendor "Redhat" for product "Enterprise Linux" and version "7.0"	-	Safe
Fasterxml Search vendor "Fasterxml"		Jackson-databind Search vendor "Fasterxml" for product "Jackson-databind"				>= 2.0.0 < 2.6.7.2 Search vendor "Fasterxml" for product "Jackson-databind" and version " >= 2.0.0 < 2.6.7.2"		-		Affected
Fasterxml Search vendor "Fasterxml"		Jackson-databind Search vendor "Fasterxml" for product "Jackson-databind"				>= 2.7.0 < 2.7.9.2 Search vendor "Fasterxml" for product "Jackson-databind" and version " >= 2.7.0 < 2.7.9.2"		-		Affected
Fasterxml Search vendor "Fasterxml"		Jackson-databind Search vendor "Fasterxml" for product "Jackson-databind"				>= 2.8.0 < 2.8.10 Search vendor "Fasterxml" for product "Jackson-databind" and version " >= 2.8.0 < 2.8.10"		-		Affected
Fasterxml Search vendor "Fasterxml"		Jackson-databind Search vendor "Fasterxml" for product "Jackson-databind"				2.9.0 Search vendor "Fasterxml" for product "Jackson-databind" and version "2.9.0"		-		Affected
Fasterxml Search vendor "Fasterxml"		Jackson-databind Search vendor "Fasterxml" for product "Jackson-databind"				2.9.0 Search vendor "Fasterxml" for product "Jackson-databind" and version "2.9.0"		prerelease1		Affected
Fasterxml Search vendor "Fasterxml"		Jackson-databind Search vendor "Fasterxml" for product "Jackson-databind"				2.9.0 Search vendor "Fasterxml" for product "Jackson-databind" and version "2.9.0"		prerelease2		Affected
Fasterxml Search vendor "Fasterxml"		Jackson-databind Search vendor "Fasterxml" for product "Jackson-databind"				2.9.0 Search vendor "Fasterxml" for product "Jackson-databind" and version "2.9.0"		prerelease3		Affected
Fasterxml Search vendor "Fasterxml"		Jackson-databind Search vendor "Fasterxml" for product "Jackson-databind"				2.9.0 Search vendor "Fasterxml" for product "Jackson-databind" and version "2.9.0"		prerelease4		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0"		-		Affected
Redhat Search vendor "Redhat"		Openshift Container Platform Search vendor "Redhat" for product "Openshift Container Platform"				3.11 Search vendor "Redhat" for product "Openshift Container Platform" and version "3.11"		-		Affected
Redhat Search vendor "Redhat"		Satellite Search vendor "Redhat" for product "Satellite"				6.4 Search vendor "Redhat" for product "Satellite" and version "6.4"		-		Affected
Redhat Search vendor "Redhat"		Satellite Capsule Search vendor "Redhat" for product "Satellite Capsule"				6.4 Search vendor "Redhat" for product "Satellite Capsule" and version "6.4"		-		Affected
Netapp Search vendor "Netapp"		Oncommand Balance Search vendor "Netapp" for product "Oncommand Balance"				-		-		Affected
Netapp Search vendor "Netapp"		Oncommand Performance Manager Search vendor "Netapp" for product "Oncommand Performance Manager"				-		linux		Affected
Netapp Search vendor "Netapp"		Oncommand Performance Manager Search vendor "Netapp" for product "Oncommand Performance Manager"				-		vmware_vsphere		Affected
Netapp Search vendor "Netapp"		Oncommand Shift Search vendor "Netapp" for product "Oncommand Shift"				-		-		Affected
Netapp Search vendor "Netapp"		Snapcenter Search vendor "Netapp" for product "Snapcenter"				-		-		Affected
Oracle Search vendor "Oracle"		Banking Platform Search vendor "Oracle" for product "Banking Platform"				2.5.0 Search vendor "Oracle" for product "Banking Platform" and version "2.5.0"		-		Affected
Oracle Search vendor "Oracle"		Banking Platform Search vendor "Oracle" for product "Banking Platform"				2.6.0 Search vendor "Oracle" for product "Banking Platform" and version "2.6.0"		-		Affected
Oracle Search vendor "Oracle"		Banking Platform Search vendor "Oracle" for product "Banking Platform"				2.6.1 Search vendor "Oracle" for product "Banking Platform" and version "2.6.1"		-		Affected
Oracle Search vendor "Oracle"		Banking Platform Search vendor "Oracle" for product "Banking Platform"				2.6.2 Search vendor "Oracle" for product "Banking Platform" and version "2.6.2"		-		Affected
Oracle Search vendor "Oracle"		Clusterware Search vendor "Oracle" for product "Clusterware"				12.1.0.2.0 Search vendor "Oracle" for product "Clusterware" and version "12.1.0.2.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Billing And Revenue Management Search vendor "Oracle" for product "Communications Billing And Revenue Management"				7.5 Search vendor "Oracle" for product "Communications Billing And Revenue Management" and version "7.5"		-		Affected
Oracle Search vendor "Oracle"		Communications Billing And Revenue Management Search vendor "Oracle" for product "Communications Billing And Revenue Management"				12.0 Search vendor "Oracle" for product "Communications Billing And Revenue Management" and version "12.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Diameter Signaling Router Search vendor "Oracle" for product "Communications Diameter Signaling Router"				< 8.3 Search vendor "Oracle" for product "Communications Diameter Signaling Router" and version " < 8.3"		-		Affected
Oracle Search vendor "Oracle"		Communications Instant Messaging Server Search vendor "Oracle" for product "Communications Instant Messaging Server"				10.0.1.2.0 Search vendor "Oracle" for product "Communications Instant Messaging Server" and version "10.0.1.2.0"		-		Affected
Oracle Search vendor "Oracle"		Database Server Search vendor "Oracle" for product "Database Server"				12.2.0.1 Search vendor "Oracle" for product "Database Server" and version "12.2.0.1"		-		Affected
Oracle Search vendor "Oracle"		Database Server Search vendor "Oracle" for product "Database Server"				18.1 Search vendor "Oracle" for product "Database Server" and version "18.1"		-		Affected
Oracle Search vendor "Oracle"		Enterprise Manager For Virtualization Search vendor "Oracle" for product "Enterprise Manager For Virtualization"				13.2.2 Search vendor "Oracle" for product "Enterprise Manager For Virtualization" and version "13.2.2"		-		Affected
Oracle Search vendor "Oracle"		Enterprise Manager For Virtualization Search vendor "Oracle" for product "Enterprise Manager For Virtualization"				13.2.3 Search vendor "Oracle" for product "Enterprise Manager For Virtualization" and version "13.2.3"		-		Affected
Oracle Search vendor "Oracle"		Enterprise Manager For Virtualization Search vendor "Oracle" for product "Enterprise Manager For Virtualization"				13.3.1 Search vendor "Oracle" for product "Enterprise Manager For Virtualization" and version "13.3.1"		-		Affected
Oracle Search vendor "Oracle"		Financial Services Analytical Applications Infrastructure Search vendor "Oracle" for product "Financial Services Analytical Applications Infrastructure"				8.0.2 Search vendor "Oracle" for product "Financial Services Analytical Applications Infrastructure" and version "8.0.2"		-		Affected
Oracle Search vendor "Oracle"		Financial Services Analytical Applications Infrastructure Search vendor "Oracle" for product "Financial Services Analytical Applications Infrastructure"				8.0.3 Search vendor "Oracle" for product "Financial Services Analytical Applications Infrastructure" and version "8.0.3"		-		Affected
Oracle Search vendor "Oracle"		Financial Services Analytical Applications Infrastructure Search vendor "Oracle" for product "Financial Services Analytical Applications Infrastructure"				8.0.4 Search vendor "Oracle" for product "Financial Services Analytical Applications Infrastructure" and version "8.0.4"		-		Affected
Oracle Search vendor "Oracle"		Financial Services Analytical Applications Infrastructure Search vendor "Oracle" for product "Financial Services Analytical Applications Infrastructure"				8.0.5 Search vendor "Oracle" for product "Financial Services Analytical Applications Infrastructure" and version "8.0.5"		-		Affected
Oracle Search vendor "Oracle"		Financial Services Analytical Applications Infrastructure Search vendor "Oracle" for product "Financial Services Analytical Applications Infrastructure"				8.0.6 Search vendor "Oracle" for product "Financial Services Analytical Applications Infrastructure" and version "8.0.6"		-		Affected
Oracle Search vendor "Oracle"		Financial Services Analytical Applications Infrastructure Search vendor "Oracle" for product "Financial Services Analytical Applications Infrastructure"				8.0.7 Search vendor "Oracle" for product "Financial Services Analytical Applications Infrastructure" and version "8.0.7"		-		Affected
Oracle Search vendor "Oracle"		Global Lifecycle Management Opatchauto Search vendor "Oracle" for product "Global Lifecycle Management Opatchauto"				< 12.2.0.1.14 Search vendor "Oracle" for product "Global Lifecycle Management Opatchauto" and version " < 12.2.0.1.14"		-		Affected
Oracle Search vendor "Oracle"		Identity Manager Search vendor "Oracle" for product "Identity Manager"				11.1.2.3.0 Search vendor "Oracle" for product "Identity Manager" and version "11.1.2.3.0"		-		Affected
Oracle Search vendor "Oracle"		Identity Manager Search vendor "Oracle" for product "Identity Manager"				12.2.1.3.0 Search vendor "Oracle" for product "Identity Manager" and version "12.2.1.3.0"		-		Affected
Oracle Search vendor "Oracle"		Jd Edwards Enterpriseone Tools Search vendor "Oracle" for product "Jd Edwards Enterpriseone Tools"				9.2 Search vendor "Oracle" for product "Jd Edwards Enterpriseone Tools" and version "9.2"		-		Affected
Oracle Search vendor "Oracle"		Primavera Unifier Search vendor "Oracle" for product "Primavera Unifier"				>= 17.1 <= 17.12 Search vendor "Oracle" for product "Primavera Unifier" and version " >= 17.1 <= 17.12"		-		Affected
Oracle Search vendor "Oracle"		Primavera Unifier Search vendor "Oracle" for product "Primavera Unifier"				16.1 Search vendor "Oracle" for product "Primavera Unifier" and version "16.1"		-		Affected
Oracle Search vendor "Oracle"		Primavera Unifier Search vendor "Oracle" for product "Primavera Unifier"				16.2 Search vendor "Oracle" for product "Primavera Unifier" and version "16.2"		-		Affected
Oracle Search vendor "Oracle"		Primavera Unifier Search vendor "Oracle" for product "Primavera Unifier"				18.8 Search vendor "Oracle" for product "Primavera Unifier" and version "18.8"		-		Affected
Oracle Search vendor "Oracle"		Utilities Advanced Spatial And Operational Analytics Search vendor "Oracle" for product "Utilities Advanced Spatial And Operational Analytics"				2.7.0.1 Search vendor "Oracle" for product "Utilities Advanced Spatial And Operational Analytics" and version "2.7.0.1"		-		Affected
Oracle Search vendor "Oracle"		Webcenter Portal Search vendor "Oracle" for product "Webcenter Portal"				12.2.1.3.0 Search vendor "Oracle" for product "Webcenter Portal" and version "12.2.1.3.0"		-		Affected