CVE-2017-7525
Critical
Description
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Fasterxml Jackson-databind
PublishedFeb 6, 2018
First seenFeb 6, 2018
Weakness typeCWE-184CWE-184
How to fix
Update
- fasterxml jackson-databind2.6.7.1, 2.7.9.1, 2.8.9 or later
- oracle communications_diameter_signaling_route8.3 or later
- oracle global_lifecycle_management_opatchauto12.2.0.1.14 or later
- com.fasterxml.jackson.core:jackson-databind2.6.7.1, 2.7.9.1, 2.8.9 or later
Vendor advisories
- access.redhat.com/errata/RHSA-2017:1840
- access.redhat.com/errata/RHSA-2017:2547
- access.redhat.com/errata/RHSA-2017:1836
- access.redhat.com/errata/RHSA-2017:1835
- access.redhat.com/errata/RHSA-2018:1449
- access.redhat.com/errata/RHSA-2017:2635
- access.redhat.com/errata/RHSA-2017:2638
- access.redhat.com/errata/RHSA-2018:1450
- access.redhat.com/errata/RHSA-2017:3458
- access.redhat.com/errata/RHSA-2018:0294
- access.redhat.com/errata/RHSA-2017:1837
- access.redhat.com/errata/RHSA-2017:1834
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fasterxml jackson-databind | v < 2.6.7.1, 2.7.0 ≤ v < 2.7.9.1, 2.8.0 ≤ v < 2.8.9, 2.9.0 | 2.6.7.1, 2.7.9.1, 2.8.9 |
| debian debian_linux | 8.0, 9.0 | — |
| netapp oncommand_balance | No range specified | — |
| netapp oncommand_performance_manager | No range specified | — |
| netapp oncommand_shift | No range specified | — |
| netapp snapcenter | No range specified | — |
| redhat openshift_container_platform | 4.1, 3.11 | — |
| redhat virtualization | 4.0 | — |
| redhat virtualization_host | 4.0 | — |
| redhat jboss_enterprise_application_platform | 6.0.0, 6.4.0, 7.0, 7.1 | — |
| oracle banking_platform | 2.5.0, 2.6.0, 2.6.1, 2.6.2 | — |
| oracle communications_billing_and_revenue_management | 7.5, 12.0 | — |
| oracle communications_communications_policy_management | 12.0 ≤ v ≤ 12.5.2 | — |
| oracle communications_diameter_signaling_route | v < 8.3 | 8.3 |
| oracle communications_instant_messaging_server | 10.0.1, 10.0.1.2.0 | — |
| oracle enterprise_manager_for_virtualization | 13.2.2, 13.2.3, 13.3.1 | — |
| oracle financial_services_analytical_applications_infrastructure | 8.0.2.0.0, 8.0.3.0.0, 8.0.4.0.0, 8.0.5.0.0, 8.0.6.0.0, 8.0.7.0.0 | — |
| oracle global_lifecycle_management_opatchauto | v < 12.2.0.1.14 | 12.2.0.1.14 |
| oracle primavera_unifier | 17.1 ≤ v ≤ 17.12, 16.1, 16.2, 18.8 | — |
| oracle utilities_advanced_spatial_and_operational_analytics | 2.7.0.1 | — |
| oracle webcenter_portal | 12.2.1.3.0 | — |
| com.fasterxml.jackson.core:jackson-databindMaven | v < 2.6.7.1, 2.7.0 ≤ v < 2.7.9.1, 2.8.0 ≤ v < 2.8.9 | 2.6.7.1, 2.7.9.1, 2.8.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.