CVE-2017-17485
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2017-17485
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-17485.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2017-17485
- Aliases
- Related
- Published
- 2018-01-10T18:29:01Z
- Modified
- 2024-10-12T02:38:52.962452Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.
- References
-
- http://www.securityfocus.com/archive/1/541652/100/0/threaded
- https://access.redhat.com/errata/RHSA-2018:0116
- https://access.redhat.com/errata/RHSA-2018:0342
- https://access.redhat.com/errata/RHSA-2018:0478
- https://access.redhat.com/errata/RHSA-2018:0479
- https://access.redhat.com/errata/RHSA-2018:0480
- https://access.redhat.com/errata/RHSA-2018:0481
- https://access.redhat.com/errata/RHSA-2018:1447
- https://access.redhat.com/errata/RHSA-2018:1448
- https://access.redhat.com/errata/RHSA-2018:1449
- https://access.redhat.com/errata/RHSA-2018:1450
- https://access.redhat.com/errata/RHSA-2018:1451
- https://access.redhat.com/errata/RHSA-2018:2930
- https://access.redhat.com/errata/RHSA-2019:1782
- https://access.redhat.com/errata/RHSA-2019:1797
- https://access.redhat.com/errata/RHSA-2019:2858
- https://access.redhat.com/errata/RHSA-2019:3149
- https://access.redhat.com/errata/RHSA-2019:3892
- https://security.netapp.com/advisory/ntap-20180201-0003/
- https://www.debian.org/security/2018/dsa-4114
- https://github.com/FasterXML/jackson-databind/issues/1855
- https://github.com/irsl/jackson-rce-via-spel/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://security-tracker.debian.org/tracker/CVE-2017-17485
Affected packages
Debian:11 / jackson-databind
Package
- Name
- jackson-databind
- Purl
- pkg:deb/debian/jackson-databind?arch=source
Debian:12 / jackson-databind
Package
- Name
- jackson-databind
- Purl
- pkg:deb/debian/jackson-databind?arch=source
Debian:13 / jackson-databind
Package
- Name
- jackson-databind
- Purl
- pkg:deb/debian/jackson-databind?arch=source
Git / github.com/fasterxml/jackson-databind
Affected ranges
- Type
- GIT
- Repo
- https://github.com/fasterxml/jackson-databind
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
2.*
2.2.0c
2.6.0-rc3b
jackson-databind-2.*
jackson-databind-2.0.0
jackson-databind-2.0.0-RC1
jackson-databind-2.0.0-RC2
jackson-databind-2.0.0-RC3
jackson-databind-2.0.1
jackson-databind-2.0.2
jackson-databind-2.0.4
jackson-databind-2.1.0
jackson-databind-2.1.1
jackson-databind-2.2.0
jackson-databind-2.2.0-rc1
jackson-databind-2.2.1
jackson-databind-2.2.2
jackson-databind-2.3.0
jackson-databind-2.3.0-rc1
jackson-databind-2.3.1
jackson-databind-2.4.0
jackson-databind-2.4.0-rc1
jackson-databind-2.4.0-rc2
jackson-databind-2.4.0-rc3
jackson-databind-2.4.1
jackson-databind-2.4.1.1
jackson-databind-2.4.1.2
jackson-databind-2.4.1.3
jackson-databind-2.4.2
jackson-databind-2.4.3
jackson-databind-2.4.4
jackson-databind-2.4.5
jackson-databind-2.4.5.1
jackson-databind-2.4.6
jackson-databind-2.5.0
jackson-databind-2.5.0-rc1
jackson-databind-2.5.1
jackson-databind-2.5.2
jackson-databind-2.5.3
jackson-databind-2.5.4
jackson-databind-2.5.5
jackson-databind-2.6.0
jackson-databind-2.6.0-rc1
jackson-databind-2.6.0-rc2
jackson-databind-2.6.0-rc4
jackson-databind-2.6.1
jackson-databind-2.6.2
jackson-databind-2.6.3
jackson-databind-2.6.4
jackson-databind-2.6.5
jackson-databind-2.6.6
jackson-databind-2.6.7
jackson-databind-2.6.7.1
jackson-databind-2.6.7.2