Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2017-17485

Опубликовано: 12 дек. 2017
Источник: redhat
CVSS3: 8.1
EPSS Высокий

Описание

FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.

A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending maliciously crafted input to the readValue method of ObjectMapper. This issue extends upon the previous flaws CVE-2017-7525 and CVE-2017-15095 by blacklisting more classes that could be used maliciously.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Enterprise Virtualization 3jasperreports-server-proWill not fix
Red Hat Fuse 7jackson-databindAffected
Red Hat JBoss A-MQ 6jackson-databindNot affected
Red Hat JBoss Data Grid 7jackson-databindNot affected
Red Hat JBoss Data Virtualization 6jackson-databindNot affected
Red Hat JBoss Fuse 6jackson-databindAffected
Red Hat Mobile Application Platform 4jackson-databindNot affected
Red Hat OpenShift Enterprise 2jackson-databindAffected
Red Hat Satellite 6jackson-databindUnder investigation
Red Hat Virtualization 4eap7-jackson-databindAffected

Показывать по

Дополнительная информация

Статус:

Important
Дефект:
CWE-502
https://bugzilla.redhat.com/show_bug.cgi?id=1528565jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095)

EPSS

Процентиль: 99%
0.79787
Высокий

8.1 High

CVSS3

Связанные уязвимости

CVSS3: 9.8
ubuntu
около 8 лет назад

FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.

CVSS3: 9.8
nvd
около 8 лет назад

FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.

CVSS3: 9.8
debian
около 8 лет назад

FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allo ...

CVSS3: 9.8
github
больше 7 лет назад

jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass

CVSS3: 9.8
fstec
около 8 лет назад

Уязвимость метода readValue класса ObjectMapper библиотеки Jackson-databind, связанная с восстановлением в памяти недостоверной структуры данных, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании

EPSS

Процентиль: 99%
0.79787
Высокий

8.1 High

CVSS3