NetSight
IP …
critical9.8

CVE-2017-15095

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code ex…

Impact

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
from 2.0.0 before 2.6.7.2
from 2.7.0 before 2.7.9.2
from 2.8.0 before 2.8.10
Version 2.9.0
DebianDebian Linux
Versions 8.0, 9.0
RedhatOpenshift Container Platform
Versions 3.11, 4.1
RedhatSatellite
Version 6.4
RedhatSatellite Capsule
Version 6.4
RedhatJboss Enterprise Application Platform
Versions 6.0.0, 6.4.0, 7.1.0
NetappOncommand Balance
All versions
NetappOncommand Performance Manager
All versions
NetappOncommand Shift
All versions
NetappSnapcenter
All versions
OracleBanking Platform
Versions 2.5.0, 2.6.0, 2.6.1, 2.6.2
OracleClusterware
Version 12.1.0.2.0

Weakness classification

CWE-184CWE-502

References