CVE-2017-15095
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
- Score
- CVSS 3.1 9.8 Critical
- Status
- Modified - secalert@redhat.com
- Published
- 2018-02-06
- Last modified
- 2026-10-08
- Weaknesses
- CWE-184, CWE-502
Affected products
- Debian Linux (Debian)
- Jackson-databind (Fasterxml)
- Oncommand Balance (Netapp)
- Oncommand Performance Manager (Netapp)
- Oncommand Shift (Netapp)
- Snapcenter (Netapp)
- Banking Platform (Oracle)
- Clusterware (Oracle)
- Communications Billing And Revenue Management (Oracle)
- Communications Diameter Signaling Router (Oracle)
- Communications Instant Messaging Server (Oracle)
- Database Server (Oracle)
- Enterprise Manager For Virtualization (Oracle)
- Financial Services Analytical Applications Infrastructure (Oracle)
- Global Lifecycle Management Opatchauto (Oracle)
- Identity Manager (Oracle)
- Jd Edwards Enterpriseone Tools (Oracle)
- Primavera Unifier (Oracle)
- Utilities Advanced Spatial And Operational Analytics (Oracle)
- Webcenter Portal (Oracle)
- Jboss Enterprise Application Platform (Redhat)
- Openshift Container Platform (Redhat)
- Satellite (Redhat)
- Satellite Capsule (Redhat)
References
- https://access.redhat.com/errata/RHSA-2018:1448
- http://www.securityfocus.com/bid/103880
- https://access.redhat.com/errata/RHSA-2018:0479
- https://access.redhat.com/errata/RHSA-2018:0481
- https://access.redhat.com/errata/RHSA-2018:1449
- https://access.redhat.com/errata/RHSA-2018:1450
- https://access.redhat.com/errata/RHSA-2018:0577
- https://access.redhat.com/errata/RHSA-2018:0576
- https://access.redhat.com/errata/RHSA-2017:3190
- https://access.redhat.com/errata/RHSA-2018:1451
- https://access.redhat.com/errata/RHSA-2017:3189
- https://access.redhat.com/errata/RHSA-2018:2927
- http://www.securitytracker.com/id/1039769
- https://access.redhat.com/errata/RHSA-2018:0342
- https://access.redhat.com/errata/RHSA-2018:0480
- https://access.redhat.com/errata/RHSA-2018:1447
- https://access.redhat.com/errata/RHSA-2018:0478
- https://www.debian.org/security/2017/dsa-4037
- https://access.redhat.com/errata/RHSA-2019:2858
- https://access.redhat.com/errata/RHSA-2019:3149
- https://access.redhat.com/errata/RHSA-2019:3892
- https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629%40%3Csolr-user.lucene.apa…
- https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://security.netapp.com/advisory/ntap-20171214-0003/
