CVE-2017-17485
Critical
Description
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Fasterxml Jackson-databind
PublishedJan 10, 2018
First seenJan 10, 2018
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- fasterxml jackson-databind2.6.7.3, 2.7.9.2, 2.8.11, 2.9.4 or later
- com.fasterxml.jackson.core:jackson-databind2.9.4, 2.8.11, 2.7.9.2 or later
Vendor advisories
- access.redhat.com/errata/RHSA-2018:1448
- access.redhat.com/errata/RHSA-2018:0479
- access.redhat.com/errata/RHSA-2018:0481
- access.redhat.com/errata/RHSA-2018:1449
- access.redhat.com/errata/RHSA-2018:1450
- access.redhat.com/errata/RHSA-2018:1451
- access.redhat.com/errata/RHSA-2018:0116
- access.redhat.com/errata/RHSA-2018:0342
- access.redhat.com/errata/RHSA-2018:0480
- access.redhat.com/errata/RHSA-2018:1447
- debian.org/security/2018/dsa-4114
- access.redhat.com/errata/RHSA-2018:0478
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fasterxml jackson-databind | v < 2.6.7.3, 2.7.0 ≤ v < 2.7.9.2, 2.8.0 ≤ v < 2.8.11, 2.9.0 ≤ v < 2.9.4 | 2.6.7.3, 2.7.9.2, 2.8.11, 2.9.4 |
| debian debian_linux | 8.0, 9.0 | — |
| redhat jboss_enterprise_application_platform | 6.0.0, 6.4.0, 7.1 | — |
| redhat openshift_container_platform | 4.1, 3.11 | — |
| netapp e-series_santricity_os_controller | 11.0.0 ≤ v ≤ 11.60.3 | — |
| netapp e-series_santricity_web_services_proxy | No range specified | — |
| netapp oncommand_shift | No range specified | — |
| netapp snapcenter | No range specified | — |
| com.fasterxml.jackson.core:jackson-databindMaven | 2.9.0 ≤ v < 2.9.4, 2.8.0 ≤ v < 2.8.11, v < 2.7.9.2 | 2.9.4, 2.8.11, 2.7.9.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.