NetSight
IP …
critical9.8

CVE-2017-7525

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform…

Impact

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
before 2.6.7.1
from 2.7.0 before 2.7.9.1
from 2.8.0 before 2.8.9
Version 2.9.0
DebianDebian Linux
Versions 8.0, 9.0
NetappOncommand Balance
All versions
NetappOncommand Performance Manager
All versions
NetappOncommand Shift
All versions
NetappSnapcenter
All versions
RedhatOpenshift Container Platform
Versions 4.1, 3.11
RedhatVirtualization
Version 4.0
RedhatVirtualization Host
Version 4.0
RedhatJboss Enterprise Application Platform
Versions 6.0.0, 6.4.0, 7.0, 7.1
OracleBanking Platform
Versions 2.5.0, 2.6.0, 2.6.1, 2.6.2
OracleCommunications Billing And Revenue Management
Versions 7.5, 12.0

Weakness classification

CWE-184CWE-502

References