CVE-2017-7525
Published: 6 February 2018
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
From the Ubuntu security team
It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could possibly use this issue to execute arbitrary code.
Priority
Medium
CVSS 3 base score: 9.8
Status
| Package | Release | Status |
|---|---|---|
|
jackson-databind Launchpad, Ubuntu, Debian |
artful |
Released
(2.8.6-1+deb9u1build0.17.10.1)
|
| bionic |
Not vulnerable
(2.9.1-1)
|
|
| cosmic |
Not vulnerable
(2.9.1-1)
|
|
| disco |
Not vulnerable
(2.9.1-1)
|
|
| eoan |
Not vulnerable
(2.9.1-1)
|
|
| focal |
Not vulnerable
(2.9.1-1)
|
|
| groovy |
Not vulnerable
(2.9.1-1)
|
|
| hirsute |
Not vulnerable
(2.9.1-1)
|
|
| impish |
Not vulnerable
(2.9.1-1)
|
|
| jammy |
Not vulnerable
(2.9.1-1)
|
|
| precise |
Does not exist
|
|
| trusty |
Does not exist
(trusty was needed)
|
|
| upstream |
Released
(2.9.1-1)
|
|
| xenial |
Ignored
(end of standard support, was needed)
|
|
| yakkety |
Ignored
(reached end-of-life)
|
|
| zesty |
Released
(2.8.6-1+deb9u1build0.17.04.1)
|
|
|
libjackson-json-java Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| focal |
Needs triage
|
|
| groovy |
Ignored
(reached end-of-life)
|
|
| hirsute |
Not vulnerable
(1.9.13-2)
|
|
| impish |
Not vulnerable
(1.9.13-2)
|
|
| jammy |
Not vulnerable
(1.9.13-2)
|
|
| precise |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Released
(1.9.2-7ubuntu0.2)
|