CVE-2017-15095
Published: 6 February 2018
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
From the Ubuntu Security Team
It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could possibly use this issue to execute arbitrary code.
Priority
Status
Package | Release | Status |
---|---|---|
jackson-databind
Launchpad, Ubuntu, Debian |
artful |
Released
(2.8.6-1+deb9u2build0.17.10.1)
|
bionic |
Not vulnerable
(2.9.1-1)
|
|
cosmic |
Not vulnerable
(2.9.1-1)
|
|
disco |
Not vulnerable
(2.9.1-1)
|
|
eoan |
Not vulnerable
(2.9.1-1)
|
|
focal |
Not vulnerable
(2.9.1-1)
|
|
groovy |
Not vulnerable
(2.9.1-1)
|
|
hirsute |
Not vulnerable
(2.9.1-1)
|
|
impish |
Not vulnerable
(2.9.1-1)
|
|
jammy |
Not vulnerable
(2.9.1-1)
|
|
kinetic |
Not vulnerable
(2.9.1-1)
|
|
lunar |
Not vulnerable
(2.9.1-1)
|
|
mantic |
Not vulnerable
(2.9.1-1)
|
|
noble |
Not vulnerable
(2.9.1-1)
|
|
trusty |
Released
(2.2.2-1ubuntu0.1~esm1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
upstream |
Released
(2.9.1-1)
|
|
xenial |
Released
(2.4.2-3ubuntu0.1~esm1)
Available with Ubuntu Pro |
|
zesty |
Released
(2.8.6-1+deb9u2build0.17.04.1)
|
|
libjackson-json-java
Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
focal |
Needs triage
|
|
groovy |
Ignored
(end of life)
|
|
hirsute |
Not vulnerable
(1.9.13-2)
|
|
impish |
Not vulnerable
(1.9.13-2)
|
|
jammy |
Not vulnerable
(1.9.13-2)
|
|
kinetic |
Not vulnerable
(1.9.13-2)
|
|
lunar |
Not vulnerable
(1.9.13-2)
|
|
mantic |
Not vulnerable
(1.9.13-2)
|
|
noble |
Not vulnerable
(1.9.13-2)
|
|
trusty |
Released
(1.9.2-3+deb8u1build0.14.04.1~esm1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
upstream |
Needs triage
|
|
xenial |
Released
(1.9.2-7ubuntu0.2)
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 9.8 |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | High |
Availability impact | High |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
References
- https://github.com/FasterXML/jackson-databind/commit/3bfbb835
- https://github.com/FasterXML/jackson-databind/issues/1680
- https://github.com/FasterXML/jackson-databind/issues/1723
- https://github.com/FasterXML/jackson-databind/issues/1737
- https://github.com/FasterXML/jackson-databind/commit/e8f043d1
- https://github.com/FasterXML/jackson-databind/commit/ddfddfba
- https://github.com/FasterXML/jackson-databind/blob/7093008aa2afe8068e120df850189ae072dfa1b2/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java#L43
- https://ubuntu.com/security/notices/USN-4741-1
- https://www.cve.org/CVERecord?id=CVE-2017-15095
- NVD
- Launchpad
- Debian