CVE-2017-7525
- State
- Published
- Severity
- Not scored
- Published
- Feb 6, 2018
- Updated
- Oct 8, 2026
- Reserved
- Apr 5, 2017
Description
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
Scores
The record has no CVSS score.
Weaknesses
Affected Products
| Product | Versions |
|---|---|
jackson-databindFasterXML |
|
References
- 1040360vdb-entry
- RHSA-2017:1840vendor-advisory
- RHSA-2017:2547vendor-advisory
- RHSA-2017:1836vendor-advisory
- RHSA-2017:1835vendor-advisory
- RHSA-2018:1449vendor-advisory
- 1039744vdb-entry
- 1039947vdb-entry
- RHSA-2017:2635vendor-advisory
- RHSA-2017:2638vendor-advisory
- RHSA-2018:1450vendor-advisory
- RHSA-2017:3458vendor-advisory
- RHSA-2018:0294vendor-advisory
- RHSA-2017:1837vendor-advisory
- RHSA-2017:1834vendor-advisory
- RHSA-2017:2546vendor-advisory
- RHSA-2017:2636vendor-advisory
- RHSA-2017:3455vendor-advisory
- RHSA-2017:2477vendor-advisory
- RHSA-2017:3456vendor-advisory
- RHSA-2018:0342vendor-advisory
- RHSA-2017:1839vendor-advisory
- 99623vdb-entry
- RHSA-2017:2637vendor-advisory
- RHSA-2017:3454vendor-advisory
- DSA-4004vendor-advisory
- RHSA-2017:3141vendor-advisory
- RHSA-2017:2633vendor-advisory
- [lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Reportmailing-list
- [lucene-dev] 20190325 [jira] [Closed] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...mailing-list
- [lucene-dev] 20190325 [jira] [Updated] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...mailing-list
- [lucene-dev] 20190325 [jira] [Assigned] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...mailing-list
- [lucene-dev] 20190325 [jira] [Resolved] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...mailing-list
- [lucene-dev] 20190325 [jira] [Updated] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...mailing-list
- RHSA-2019:0910vendor-advisory
- RHSA-2019:2858vendor-advisory
- RHSA-2019:3149vendor-advisory
- [cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15416) CVE-2017-7525 ( jackson-databind is vulnerable to Remote Code Execution) on version 3.11.4mailing-list
- [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilitiesmailing-list
- [lucene-solr-user] 20191218 CVE-2017-7525 fix for Solr 7.7.xmailing-list
- [lucene-solr-user] 20191218 Re: CVE-2017-7525 fix for Solr 7.7.xmailing-list
- [lucene-solr-user] 20191219 Re: CVE-2017-7525 fix for Solr 7.7.xmailing-list
- [debian-lts-announce] 20200131 [SECURITY] [DLA 2091-1] libjackson-json-java security updatemailing-list
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- [debian-lts-announce] 20200824 [SECURITY] [DLA 2342-1] libjackson-json-java security updatemailing-list
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us
- https://github.com/FasterXML/jackson-databind/issues/1723
- https://github.com/FasterXML/jackson-databind/issues/1599
- https://bugzilla.redhat.com/show_bug.cgi?id=1462702
- https://security.netapp.com/advisory/ntap-20171214-0002/
- https://cwiki.apache.org/confluence/display/WW/S2-055
- [spark-issues] 20210223 [jira] [Created] (SPARK-34511) Current Security vulnerabilities in spark librariesmailing-list
- [cassandra-commits] 20210927 [jira] [Commented] (CASSANDRA-15416) CVE-2017-7525 ( jackson-databind is vulnerable to Remote Code Execution) on version 3.11.4mailing-list
- [cassandra-commits] 20210927 [jira] [Updated] (CASSANDRA-15416) CVE-2017-7525 ( jackson-databind is vulnerable to Remote Code Execution) on version 3.11.4mailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.