CVE-2017-7525

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2017-7525

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-7525.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2017-7525

Aliases

GHSA-qxxx-2pp7-5hmx

Related

Published

2018-02-06T15:29:00Z

Modified

2024-10-12T02:51:56.637722Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

References

Affected packages

Debian:11 / jackson-databind

Package

Name: jackson-databind
Purl: pkg:deb/debian/jackson-databind?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.9.1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / jackson-databind

Package

Name: jackson-databind
Purl: pkg:deb/debian/jackson-databind?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.9.1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / jackson-databind

Package

Name: jackson-databind
Purl: pkg:deb/debian/jackson-databind?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.9.1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:11 / libjackson-json-java

Package

Name: libjackson-json-java
Purl: pkg:deb/debian/libjackson-json-java?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.9.13-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / libjackson-json-java

Package

Name: libjackson-json-java
Purl: pkg:deb/debian/libjackson-json-java?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.9.13-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / libjackson-json-java

Package

Name: libjackson-json-java
Purl: pkg:deb/debian/libjackson-json-java?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.9.13-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/fasterxml/jackson-databind

Affected ranges

Type: GIT
Repo: https://github.com/fasterxml/jackson-databind
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

f7abd682a7b2f8145ecff1c4e205073949f1e623

Affected versions

2.*

2.2.0c

2.6.0-rc3b

jackson-databind-2.*

jackson-databind-2.0.0

jackson-databind-2.0.0-RC1

jackson-databind-2.0.0-RC2

jackson-databind-2.0.0-RC3

jackson-databind-2.0.1

jackson-databind-2.0.2

jackson-databind-2.0.4

jackson-databind-2.1.0

jackson-databind-2.1.1

jackson-databind-2.2.0

jackson-databind-2.2.0-rc1

jackson-databind-2.2.1

jackson-databind-2.2.2

jackson-databind-2.3.0

jackson-databind-2.3.0-rc1

jackson-databind-2.3.1

jackson-databind-2.4.0

jackson-databind-2.4.0-rc1

jackson-databind-2.4.0-rc2

jackson-databind-2.4.0-rc3

jackson-databind-2.4.1

jackson-databind-2.4.1.1

jackson-databind-2.4.1.2

jackson-databind-2.4.1.3

jackson-databind-2.4.2

jackson-databind-2.4.3

jackson-databind-2.4.4

jackson-databind-2.4.5

jackson-databind-2.4.5.1

jackson-databind-2.4.6

jackson-databind-2.5.0

jackson-databind-2.5.0-rc1

jackson-databind-2.5.1

jackson-databind-2.5.2

jackson-databind-2.5.3

jackson-databind-2.5.4

jackson-databind-2.5.5

jackson-databind-2.6.0

jackson-databind-2.6.0-rc1

jackson-databind-2.6.0-rc2

jackson-databind-2.6.0-rc4

jackson-databind-2.6.1

jackson-databind-2.6.2

jackson-databind-2.6.3

jackson-databind-2.6.4

jackson-databind-2.6.5

jackson-databind-2.6.6

jackson-databind-2.6.7