Описание
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.
| Релиз | Статус | Примечание |
|---|---|---|
| artful | ignored | end of life |
| bionic | not-affected | 2.9.4-1 |
| cosmic | not-affected | 2.9.4-1 |
| devel | not-affected | 2.9.4-1 |
| disco | not-affected | 2.9.4-1 |
| eoan | not-affected | 2.9.4-1 |
| esm-apps/bionic | not-affected | 2.9.4-1 |
| esm-apps/focal | not-affected | 2.9.4-1 |
| esm-apps/jammy | not-affected | 2.9.4-1 |
| esm-apps/xenial | released | 2.4.2-3ubuntu0.1~esm1 |
Показывать по
7.5 High
CVSS2
9.8 Critical
CVSS3
Связанные уязвимости
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allo ...
jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass
Уязвимость метода readValue класса ObjectMapper библиотеки Jackson-databind, связанная с восстановлением в памяти недостоверной структуры данных, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
7.5 High
CVSS2
9.8 Critical
CVSS3