CVE-2017-15095
- State
- Published
- Severity
- Not scored
- Published
- Feb 6, 2018
- Updated
- Oct 8, 2026
- Reserved
- Oct 8, 2017
Description
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
Scores
The record has no CVSS score.
Weaknesses
Affected Products
| Product | Versions |
|---|---|
jackson-databindFasterXML |
|
References
- RHSA-2018:1448vendor-advisory
- 103880vdb-entry
- RHSA-2018:0479vendor-advisory
- RHSA-2018:0481vendor-advisory
- RHSA-2018:1449vendor-advisory
- RHSA-2018:1450vendor-advisory
- RHSA-2018:0577vendor-advisory
- RHSA-2018:0576vendor-advisory
- RHSA-2017:3190vendor-advisory
- RHSA-2018:1451vendor-advisory
- RHSA-2017:3189vendor-advisory
- RHSA-2018:2927vendor-advisory
- 1039769vdb-entry
- RHSA-2018:0342vendor-advisory
- RHSA-2018:0480vendor-advisory
- RHSA-2018:1447vendor-advisory
- RHSA-2018:0478vendor-advisory
- DSA-4037vendor-advisory
- RHSA-2019:2858vendor-advisory
- RHSA-2019:3149vendor-advisory
- RHSA-2019:3892vendor-advisory
- [lucene-solr-user] 20191219 Re: CVE-2017-7525 fix for Solr 7.7.xmailing-list
- [debian-lts-announce] 20200131 [SECURITY] [DLA 2091-1] libjackson-json-java security updatemailing-list
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://security.netapp.com/advisory/ntap-20171214-0003/
- https://github.com/FasterXML/jackson-databind/issues/1737
- https://github.com/FasterXML/jackson-databind/issues/1680
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.