CVE-2017-15095
CRITICAL
jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution
Published October 18, 2018Updated March 15, 2024Source: osv
Summary
jackson-databind in versions prior to 2.8.11 and 2.9.4 contain a deserialization flaw which allows an unauthenticated user to perform code execution by sending maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525, blacklisting additonal vulnerable classes.
Remediation
Upgrade to the fixed version using your package manager.
Maven
Update com.fasterxml.jackson.core:jackson-databind to 2.7.9.2 or later<!-- Update pom.xml dependency version to 2.7.9.2 for com.fasterxml.jackson.core:jackson-databind -->
Maven
Update com.fasterxml.jackson.core:jackson-databind to 2.9.4 or later<!-- Update pom.xml dependency version to 2.9.4 for com.fasterxml.jackson.core:jackson-databind -->
Maven
Update com.fasterxml.jackson.core:jackson-databind to 2.6.7.3 or later<!-- Update pom.xml dependency version to 2.6.7.3 for com.fasterxml.jackson.core:jackson-databind -->
Maven
Update com.fasterxml.jackson.core:jackson-databind to 2.8.11 or later<!-- Update pom.xml dependency version to 2.8.11 for com.fasterxml.jackson.core:jackson-databind -->
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (4)
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| com.fasterxml.jackson.core:jackson-databind | maven | 2.7.0, 2.7.1, 2.7.1-1, 2.7.2 (+8 more) | 2.7.9.2 |
| com.fasterxml.jackson.core:jackson-databind | maven | 2.9.0, 2.9.0.pr1, 2.9.0.pr2, 2.9.0.pr3 (+4 more) | 2.9.4 |
| com.fasterxml.jackson.core:jackson-databind | maven | 2.0.0, 2.0.1, 2.0.2, 2.0.4 (+57 more) | 2.6.7.3 |
| com.fasterxml.jackson.core:jackson-databind | maven | 2.8.0, 2.8.1, 2.8.10, 2.8.2 (+8 more) | 2.8.11 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-184
- CWE-502Deserialization of Untrusted DataMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-15095ADVISORY
- https://github.com/FasterXML/jackson-databind/issues/1680WEB
- https://github.com/FasterXML/jackson-databind/issues/1737WEB
- https://github.com/FasterXML/jackson-databind/commit/a054585e2175ad0882f07bcafedecfac86230f1bWEB
- https://github.com/FasterXML/jackson-databind/commit/a3939d36edcc755c8af55bdc1969e0fa8438f9dbWEB
- https://github.com/FasterXML/jackson-databind/commit/ddfddfba6414adbecaff99684ef66eebd3a92e92WEB
- https://github.com/FasterXML/jackson-databind/commit/e865a7a4464da63ded9f4b1a2328ad85c9ded78bWEB
- https://github.com/FasterXML/jackson-databind/commit/e8f043d1aac9b82eee907e0f0c3abbdea723a935WEB
- https://github.com/tolbertam/jackson-databind/commit/80566a0f96b2003863f9d8f9ccc3b562001e147bWEB
- https://access.redhat.com/errata/RHSA-2017:3189WEB
- https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629@%3Csolr-user.lucene.apache.org%3EWEB
- https://lists.debian.org/debian-lts-announce/2020/01/msg00037.htmlWEB
- https://security.netapp.com/advisory/ntap-20171214-0003WEB
- https://web.archive.org/web/20200401000000*/http://www.securityfocus.com/bid/103880WEB
- https://web.archive.org/web/20201221192044/http://www.securitytracker.com/id/1039769WEB
- https://www.debian.org/security/2017/dsa-4037WEB
- https://www.oracle.com/security-alerts/cpuoct2020.htmlWEB
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlWEB
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlWEB
- https://access.redhat.com/errata/RHSA-2017:3190WEB
- https://access.redhat.com/errata/RHSA-2018:0342WEB
- https://access.redhat.com/errata/RHSA-2018:0478WEB
- https://access.redhat.com/errata/RHSA-2018:0479WEB
- https://access.redhat.com/errata/RHSA-2018:0480WEB
- https://access.redhat.com/errata/RHSA-2018:0481WEB
- https://access.redhat.com/errata/RHSA-2018:0576WEB
- https://access.redhat.com/errata/RHSA-2018:0577WEB
- https://access.redhat.com/errata/RHSA-2018:1447WEB
- https://access.redhat.com/errata/RHSA-2018:1448WEB
- https://access.redhat.com/errata/RHSA-2018:1449WEB
- https://access.redhat.com/errata/RHSA-2018:1450WEB
- https://access.redhat.com/errata/RHSA-2018:1451WEB
- https://access.redhat.com/errata/RHSA-2018:2927WEB
- https://access.redhat.com/errata/RHSA-2019:2858WEB
- https://access.redhat.com/errata/RHSA-2019:3149WEB
- https://access.redhat.com/errata/RHSA-2019:3892WEB
- https://github.com/FasterXML/jackson-databindPACKAGE
- https://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlWEB
- https://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlWEB
- https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlWEB
Frequently Asked Questions
- What is CVE-2017-15095?
- jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2017-15095?
- CVE-2017-15095 affects com.fasterxml.jackson.core:jackson-databind. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2017-15095 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
9.8
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
GHSA-h592-38cm-4ggp
Related CVEs
- CVE-2020-8840CRITICAL
Deserialization of Untrusted Data in jackson-databind
- CVE-2018-14718CRITICAL
Arbitrary Code Execution in jackson-databind
- CVE-2018-14721CRITICAL
Server-Side Request Forgery (SSRF) in jackson-databind
- CVE-2018-19362CRITICAL
com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data
- CVE-2018-7489CRITICAL
FasterXML jackson-databind allows unauthenticated remote code execution
- CVE-2019-20330CRITICAL
Deserialization of Untrusted Data in jackson-databind
- CVE-2026-54512HIGH
jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation
- CVE-2026-54513HIGH
jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies