Critical severity · published Feb 6, 2018
CVE-2017-15095
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending…
9.8
CVSS
8.4%
EPSS
No
On KEV
Description
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)8.4% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JA
jackson-databind · FasterXML
before 2.8.10; before 2.9.1 · source: vendor, NVD
BP
Banking Platform · Oracle
2.5.0; 2.6.0; 2.6.1; 2.6.2 · source: NVD
CL
Clusterware · Oracle
12.1.0.2.0 · source: NVD
CB
Communications Billing And Revenue Management · Oracle
7.5; 12.0 · source: NVD
CD
Communications Diameter Signaling Router · Oracle
before 8.3 · source: NVD
CI
Communications Instant Messaging Server · Oracle
10.0.1.2.0 · source: NVD
DS
Database Server · Oracle
12.2.0.1; 18.1 · source: NVD
DL
Debian Linux · Debian
8.0; 9.0 · source: NVD
EM
Enterprise Manager For Virtualization · Oracle
13.2.2; 13.2.3; 13.3.1 · source: NVD
FS
Financial Services Analytical Applications Infrastructure · Oracle
8.0.2; 8.0.3; 8.0.4; 8.0.5; 8.0.6; 8.0.7 · source: NVD
GL
Global Lifecycle Management Opatchauto · Oracle
before 12.2.0.1.14 · source: NVD
IM
Identity Manager · Oracle
11.1.2.3.0; 12.2.1.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-15095
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-15095
Patch
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
Patch
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
Patch
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Third Party Advisory
http://www.securityfocus.com/bid/103880
Third Party Advisory
http://www.securitytracker.com/id/1039769
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3189
More from jackson-databind
10.0
CVE-2018-14721
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class…
9.8
CVE-2026-110879
jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)
9.8
CVE-2019-14893
A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the…
9.8
CVE-2019-14892
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using…
9.8
CVE-2020-9546
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…