CVE-2017-7525
Published: 6 February 2018
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
From the Ubuntu Security Team
It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could possibly use this issue to execute arbitrary code.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
jackson-databind Launchpad, Ubuntu, Debian |
artful |
Released
(2.8.6-1+deb9u1build0.17.10.1)
|
| bionic |
Not vulnerable
(2.9.1-1)
|
|
| cosmic |
Not vulnerable
(2.9.1-1)
|
|
| disco |
Not vulnerable
(2.9.1-1)
|
|
| eoan |
Not vulnerable
(2.9.1-1)
|
|
| focal |
Not vulnerable
(2.9.1-1)
|
|
| groovy |
Not vulnerable
(2.9.1-1)
|
|
| hirsute |
Not vulnerable
(2.9.1-1)
|
|
| impish |
Not vulnerable
(2.9.1-1)
|
|
| jammy |
Not vulnerable
(2.9.1-1)
|
|
| kinetic |
Not vulnerable
(2.9.1-1)
|
|
| precise |
Does not exist
|
|
| trusty |
Released
(2.2.2-1ubuntu0.1~esm1)
|
|
| upstream |
Released
(2.9.1-1)
|
|
| xenial |
Released
(2.4.2-3ubuntu0.1~esm1)
|
|
| yakkety |
Ignored
(reached end-of-life)
|
|
| zesty |
Released
(2.8.6-1+deb9u1build0.17.04.1)
|
|
|
libjackson-json-java Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| focal |
Needs triage
|
|
| groovy |
Ignored
(reached end-of-life)
|
|
| hirsute |
Not vulnerable
(1.9.13-2)
|
|
| impish |
Not vulnerable
(1.9.13-2)
|
|
| jammy |
Not vulnerable
(1.9.13-2)
|
|
| kinetic |
Not vulnerable
(1.9.13-2)
|
|
| precise |
Does not exist
|
|
| trusty |
Released
(1.9.2-3+deb8u1build0.14.04.1~esm1)
|
|
| upstream |
Needs triage
|
|
| xenial |
Released
(1.9.2-7ubuntu0.2)
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 9.8 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |